CVE-2026-85427

MOOS essential-moos pAntler through version 10.0.1 contains an unauthenticated remote code execution flaw (CWE-494) in how it handles mission files. An attacker with network access to the MOOSDB can publish a crafted MISSION_FILE message containing malicious Run entries; pAntler parses these entries and launches the named programs via execvp() without any authentication or integrity validation. Successful exploitation yields arbitrary program execution in the context of the pAntler process, typically giving the attacker control of the robotics host or vehicle control computer running the MOOS community. Affected users are operators of MOOS-based autonomy deployments, most commonly research, academic, and maritime/robotics programs, running pAntler at version 10.0.1 or earlier. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.4% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade pAntler/essential-moos to a release newer than 10.0.1 when a patched version is published. Until then, restrict network access to the MOOSDB so only trusted hosts can connect, firewall any MOOSDB listener from untrusted networks, and audit deployments for pAntler instances reachable by unauthenticated clients.