Is CVE-2026-112352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112352 being exploited in the wild.

How severe is CVE-2026-112352?

Critical severity, with a CVSS score of 9.1, published 27 October 2026.

Which products and versions are affected?

Sunhillo Sureline 8.0.0 before 9.1.5.

Is there a fix for CVE-2026-112352?

Yes: fixed in SureLine 9.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112352 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-112352?

Check whether you run Sunhillo Sureline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112352: Sunhillo SureLine authentication bypass via session cookie

CVE-2026-112352 · Severity: critical · CVSS 9.1 · Published 2026-10-27

Sunhillo SureLine is a web-based appliance management system used to administer network infrastructure. An unauthenticated attacker can forge a session cookie with only a cleartext username to bypass authentication and impersonate any user, then execute commands with root privileges on the appliance.

Technologies: Sunhillo Sureline. Vendors: Sunhillo.

Quick answers

Is CVE-2026-112352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112352 being exploited in the wild.
How severe is CVE-2026-112352?: Critical severity, with a CVSS score of 9.1, published 27 October 2026.
Which products and versions are affected?: Sunhillo Sureline 8.0.0 before 9.1.5.
Is there a fix for CVE-2026-112352?: Yes: fixed in SureLine 9.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112352 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-112352?: Check whether you run Sunhillo Sureline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SureLine 9.1.5

Technical details

The vulnerability exists in the checkLogin function within libwebcmn.so and networkDiag.cgi, which validates session cookies based solely on a cleartext username without cryptographic integrity checks or random identifiers. An unauthenticated remote attacker can forge a session cookie containing a guessed default account name (such as "Admin" or "sftp_user") to satisfy the login check and gain authenticated access, chaining into arbitrary root command execution.

Affected products

Sunhillo SureLine 8.0.0 before 9.1.5

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.