CVE-2026-85434

CriticalCVSS 9.1

Published: 03/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

Risk Assessment

Potential interception and redirection of bridged traffic, leading to data leakage and communication integrity compromise.

Recommendation

Update uFldShoreBroker to a patched version. Verify authenticity of NODE_BROKER_PING messages before creating routes.

Other vulnerabilities in MOOS-IvP uFldShoreBroker

CVE-2026-85448High
uFldShoreBroker in MOOS-IvP through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory exhaustion and performance degradation.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS