PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24352 PluXml CVE debrief

PluXml CMS contains a session fixation vulnerability (CWE-384) where a user's session identifier can be set prior to authentication and persists unchanged after successful authentication. This allows an attacker to predetermine a session ID for a victim and subsequently hijack the authenticated session. The vulnerability was reported to the vendor without response regarding vulnerability details or affected version ranges. Testing confirmed exploitation in versions 5.8.21 and 5.9.0-rc7; other versions remain untested but may also be vulnerable. The issue carries a CVSS 4.0 score of 4.8 (MEDIUM severity) with local attack vector, low attack complexity, and requires user interaction.

Vendor
PluXml
Product
PluXml CMS
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-27
Original CVE updated
2026-05-19
Advisory published
2026-02-27
Advisory updated
2026-05-19

Who should care

Organizations running PluXml CMS instances, particularly versions 5.8.21 or 5.9.0-rc7, should prioritize session management review. Security teams monitoring for session-based attacks and web application administrators responsible for CMS security posture should assess exposure. The medium severity and local attack vector reduce widespread exploitation risk but targeted attacks against specific PluXml deployments remain viable.

Technical summary

The vulnerability stems from PluXml CMS accepting externally-provided session identifiers before user authentication and failing to regenerate the session ID upon successful authentication. This creates a session fixation condition where an attacker who can control or predict the pre-authentication session ID gains access to the authenticated session. The attack requires local access or ability to influence the victim's session initialization, with user interaction needed. CVSS 4.0 scoring reflects limited confidentiality and integrity impact with no availability impact.

Defensive priority

medium

Recommended defensive actions

  • Review PluXml session management implementation for session regeneration upon authentication
  • Implement session ID regeneration after successful login to invalidate pre-authentication session identifiers
  • Audit application logs for anomalous session ID patterns or authentication events with predictable session identifiers
  • Consider implementing additional session binding to client attributes (IP, user-agent) where feasible
  • Monitor for unauthorized access attempts using fixed session IDs if exploitation is suspected
  • Contact PluXml vendor for official patch status and affected version guidance

Evidence notes

Confirmed vulnerable in PluXml 5.8.21 and 5.9.0-rc7 per NVD CPE data. Vendor notification occurred without response. CVSS 4.0 vector: AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N.

Official resources

2026-02-27