CVE-2026-85181

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

  • Published Sep 3, 2026
  • CVSS 9.3 critical
  • 0.7% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-85181 at the National Vulnerability Database