CVE-2026-85427: MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSIONFILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments running the affected pAntler component through version 10.0.1 are exposed if an attacker can publish messages to the MOOSDB. No authentication is required by pAntler for the malicious MISSION_FILE message.
What does an attacker need to do to exploit this issue?
An attacker must publish a crafted MISSION_FILE message to the MOOSDB. The mission file can contain malicious Run entries that pAntler parses and passes to execvp(), resulting in execution of arbitrary programs.
Is user interaction or prior access required?
No user interaction or prior privileges are required. Exploitation is network-based, although the attacker needs the ability to publish the crafted message to the target MOOSDB.