Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85451MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

High 7.1

In plain English

A high-severity hard-coded credentials in core-moos from themoos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.

Affected products (as reported)

Vendor	Product	Versions
themoos	core-moos	0 – through 10.4.0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References

Pull Request #85 issue-tracking, patch
Proposed fix commit (pull request not merged) patch
https://github.com/themoos/core-moos product
SuicidalSleeper.cpp (verified sink) technical-description
VulnCheck Advisory: MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase third-party-advisory