CVE-2026-85435
CVE-2026-85435
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-85435?
- CVE-2026-85435 is a critical-severity vulnerability, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.1/10. Published 2026-09-03.
- How severe is CVE-2026-85435?
- Critical severity. CVSS v3 base score is 9.1 out of 10.