CVE-2026-66745 ArticaTech CVE debrief

Who should care

Defenders responsible for Artica Proxy instances, especially those with administrative access exposed to untrusted networks, should verify exposure and apply the hotfix 20260724-02.

Why it matters

CVE-2026-66745 is a session fixation vulnerability in Artica Proxy that allows unauthenticated attackers to hijack administrative sessions. Defenders should verify exposure, apply the hotfix, and monitor for suspicious activity.

• Verify exposure of Artica Proxy instances to untrusted networks
• Apply hotfix 20260724-02 to vulnerable instances
• Monitor for suspicious administrative session activity on port 9000
• Assess potential for session hijacking in existing administrative sessions

Technical summary

The session fixation vulnerability in Artica Proxy allows an unauthenticated attacker to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. The attacker can then gain a fully authenticated administrative session on port 9000 after the victim authenticates through fw.login.php. This vulnerability affects Artica Proxy before 4.50.000000 Service Pack 7 and has been fixed in hotfix 20260724-02. Defenders should prioritize verifying exposure of Artica Proxy instances, especially those with administrative access exposed to untrusted networks, and apply the hotfix 20260724-02.

Defensive priority

Defenders should prioritize verifying exposure of Artica Proxy instances, especially those with administrative access exposed to untrusted networks, and apply the hotfix 20260724-02.

Recommended defensive actions

• Verify exposure of Artica Proxy instances, especially those with administrative access exposed to untrusted networks
• Apply the hotfix 20260724-02 to vulnerable Artica Proxy instances
• Monitor for suspicious administrative session activity on port 9000
• Assess potential for session hijacking in existing administrative sessions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the session fixation vulnerability in Artica Proxy. Vendor documentation and a security advisory from Vulncheck provide additional context. The vulnerability has been fixed in hotfix 20260724-02. The CVE record was published on 2026-07-28T19:17:41.440Z and has not been modified since then. The NVD entry provides a CVSS score of 7.5 and a severity rating of HIGH. The vulnerability affects Artica Proxy instances with administrative access exposed to untrusted networks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.