External risk intelligence

MOOS-IvP uFldNodeBroker Unauthenticated Shore Route Enrollment.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85435

MOOS-IvP is a specialized software suite used for autonomous vehicle (marine robotics) research and operations. It functions on internal vehicle bus networks or private, isolated mission communication links, not as a public-facing internet service or web application.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the uFldNodeBroker component of MOOS-IvP, a system used in marine autonomous vehicles. This issue could allow an unauthorized party to enroll malicious shore routes, potentially enabling them to intercept sensitive vehicle data, including sensor readings and control commands. The primary concern is to verify if this technology is in use and assess any exposure.

Unauthenticated control of vehicle communications.
Intercepts sensor data and control information.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a vehicle's data by publishing unauthorized messages that enroll fake shore routes. This would trick the vehicle into sending sensitive information, such as sensor readings and control commands, to an attacker-controlled location.

Unauthenticated access to the vehicle bus is required.
Publishing fake "TRY_SHORE_HOST" messages triggers the vulnerability.
Risk of data interception and manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect systems using MOOS-IvP when a TRY_SHORE_HOST message is not properly validated. An attacker could potentially enroll unauthorized shore routes, leading to the exposure of bridged vehicle traffic. This traffic may include sensitive sensor data and control information transmitted over the vehicle bus.

Bridged vehicle traffic, including sensor data.
Any publisher can enroll attacker-controlled routes.
Exposure of sensor data and control information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MOOS-IvP's uFldNodeBroker could allow unauthorized publishers to inject malicious shore routes, potentially leading to the interception of sensitive vehicle data. The primary concern falls to the team responsible for the autonomous vehicle's software and communication infrastructure, likely an internal development or operations team. The immediate first step is to identify all instances of the affected software within the fleet, assess their network exposure, and determine business criticality before planning a coordinated remediation.

Own the risk and remediation planning.
Verify affected nodes and network exposure.
Coordinate updates and monitor for anomalies.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS-IvP?

MOOS-IvP is an open-source software suite designed for autonomous marine robotics. It provides the autonomy architecture and messaging tools necessary for vehicles to manage mission tasks, navigation, and communication between nodes on a vehicle bus. Researchers and developers use it to coordinate decentralized autonomous platforms in both simulation and real-world marine environments.

What is the vulnerability in CVE-2026-85435?

This vulnerability is an Insufficient Verification of Data Authenticity (CWE-345). It means the uFldNodeBroker component blindly trusts incoming messages regarding shore route connections. Because the system fails to verify the source of these messages, it allows any entity on the bus to impersonate or redirect communication paths, effectively breaking the trust boundary for data transmission.

How does an attacker trigger this issue?

The vulnerability is triggered when a node on the vehicle bus publishes a malformed or unauthorized TRY_SHORE_HOST message. The system accepts this message without authentication, enrolling the attacker's path as a valid shore route. Importantly, valid system operations are not affected unless a malicious party has gained the ability to publish directly to the vehicle's internal communications bus.

Do I need to worry about internet access for this?

According to Halo Surface Signal, this is very unlikely to be an internet-facing risk. MOOS-IvP typically operates on isolated vehicle bus networks or private mission links rather than the public web. Therefore, the threat is primarily relevant to those who have local or bridged access to the specific communication networks where these autonomous vehicles operate.

How should I respond to this threat?

Begin by auditing your deployment environment to identify all instances of MOOS-IvP currently running within your fleet. Since the component is used for internal communication, verify which systems have access to the vehicle bus and restrict network connectivity to only authorized publishers. Once verified, coordinate with your technical team to apply the necessary software updates to secure the route enrollment process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.