CVE-2026-120223 Oray CVE debrief

Who should care

Defenders responsible for Oray Pugongying X5 Pro deployments, security teams, vulnerability management teams, and operators of affected systems should assess exposure and verify session management practices to mitigate potential risks. They should also monitor for potential exploitation attempts and review compensating controls for exposed systems.

Why it matters

CVE-2026-120223 is a vulnerability in Oray Pugongying X5 Pro that affects session ID generation. Defenders should verify session management practices and assess exposure to potential session ID prediction attacks.

• Verify session management practices for Oray Pugongying X5 Pro deployments
• Assess exposure to potential session ID prediction attacks
• Monitor for potential exploitation attempts

Technical summary

The vulnerability affects the session_get function in session.lua of Oray Pugongying X5 Pro up to 7.6.1. The manipulation of the _user argument leads to insufficiently random session ID values, making it possible for attackers to predict session IDs. This could allow for unauthorized access or session hijacking. Defenders should verify session management practices and assess exposure to potential session ID prediction attacks. The attack's complexity is rated as high, and exploitability is considered difficult. The exploit is publicly available, and defenders should monitor for potential exploitation attempts.

Defensive priority

Verify session management practices for Oray Pugongying X5 Pro deployments.

Recommended defensive actions

• Verify and update Oray Pugongying X5 Pro to the latest version if available
• Review session management practices for Oray Pugongying X5 Pro deployments
• Monitor for potential exploitation attempts
• Assess exposure to potential session ID prediction attacks
• Verify session management practices for Oray Pugongying X5 Pro deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected versions. Defenders should verify session management practices and assess exposure to potential session ID prediction attacks. The exploit is publicly available, and defenders should monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.