Critical severity9.8NVD Advisory· Published Sep 3, 2026· Updated Sep 8, 2026
CVE-2026-85426
CVE-2026-85426
Description
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uMemWatch/MemWatch.cppnvd
- github.com/moos-ivp/moos-ivp/commit/0b2bd991b0ca7139b1edcf271473d33e7eccfc20nvd
- github.com/moos-ivp/moos-ivp/pull/121nvd
- www.vulncheck.com/advisories/moos-ivp-through-24.8.1-umemwatch-command-injection-via-moos-client-namesnvd
News mentions
1- Moos Ivp: 16 Vulnerabilities Including RCE and DoS Disclosed TogetherVypr Intelligence · Sep 3, 2026