External risk intelligence

MOOS essential-moos pShare Route Reconfiguration Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85433

MOOS (Mission Oriented Operating Suite) is specialized middleware primarily used for autonomous underwater vehicles and robotics research. It operates within isolated, private control networks for inter-process communication and is not designed or commonly deployed as a public-internet-facing service.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in MOOS essential-moos software that could allow unauthorized modification of network routes and data flow at runtime. This could potentially lead to the redirection or duplication of critical communication traffic.

Unauthorized control of network traffic is possible.
Essential for secure autonomous system operations.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted messages over the network to the vulnerable component, potentially from an unauthenticated position. This allows them to manipulate network routes and listeners at runtime, which could lead to redirection or duplication of sensitive traffic to destinations controlled by the attacker.

No authentication required.
Send crafted PSHARE_CMD messages.
Redirect or duplicate bus traffic.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to reconfigure network routes and listeners in the MOOS pShare service. When supported by the advisory, this could lead to redirection or duplication of bus traffic to attacker-controlled destinations, potentially impacting system operations.

System network configurations and listeners.
Crafting PSHARE_CMD messages to manipulate traffic.
Potential for unauthorized data redirection or duplication.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MOOS essential-moos pShare affects systems that use it for runtime network reconfiguration. Ownership likely lies with the application or platform teams responsible for the MOOS deployment, with coordination from security teams. The immediate first step is to identify all instances of essential-moos, assess their network exposure and criticality, and pinpoint the accountable owners before planning remediation.

Application or platform teams own the issue.
Verify affected systems and their exposure.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS essential-moos?

MOOS, or Mission Oriented Operating Suite, is specialized middleware designed for autonomous robotics and underwater vehicle communication. It enables different software processes to share data and coordinate tasks. The pShare component specifically acts as a bridge, managing how information is moved between different network nodes within these autonomous systems.

What does CWE-862 mean for CVE-2026-85433?

CWE-862 refers to Missing Authorization. In the context of CVE-2026-85433, it means the pShare service lacks the necessary security checks to verify who is sending a command. Because of this, the software blindly trusts any incoming message, allowing an unauthorized user to change internal routing configurations as if they were a legitimate administrator.

How do attackers trigger this pShare vulnerability?

An attacker triggers the flaw by sending a specially formatted network message known as PSHARE_CMD. No complex prerequisite or prior authentication is needed. Simply sending these crafted messages—specifically those containing input or output parameters—causes the software to execute the unauthorized command, such as opening new network listeners or redirecting existing data traffic.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that MOOS is typically deployed in private, isolated control networks for robotics, rather than on the public internet. While the vulnerability allows for remote manipulation, the specialized nature and non-public architecture of these systems make internet-based exploitation very unlikely compared to standard office or web applications.

What should I do if I run essential-moos?

First, locate all running instances of essential-moos within your infrastructure to understand your footprint. Coordinate with the application or platform teams that manage your specific robotics or autonomous deployments. Assess whether these systems are accessible from wider networks and prioritize securing the network perimeter around your MOOS communication bus while preparing for software updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.