Is CVE-2026-85425 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85425?

CVE-2026-85425 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-85425

Description

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.