CVE-2026-85435
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.
- Published Sep 3, 2026
- CVSS 9.3 critical
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available