Quick answers
- Is CVE-2026-1758 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-1758 being exploited in the wild.
- How severe is CVE-2026-1758?
- High severity, with a CVSS score of 8.3, published 15 September 2026.
- Which products and versions are affected?
- Secomea GateManager 11.5.0, 11.4.625515072.
- Is there a fix for CVE-2026-1758?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-1758 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-1758?
- Check whether you run Secomea GateManager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a session fixation vulnerability in the webserver module of Secomea GateManager that allows an attacker to force a user to use a known session identifier. The vulnerability affects versions 11.5.0 and 11.4.625515072. An attacker can exploit this by tricking a user into accessing a malicious link containing a pre-generated session ID, and if the application does not regenerate the session ID upon authentication, the attacker can then use the same session ID to gain unauthorized access. The vulnerability has been patched in version 11.6 and later, as well as in version 11.4.626194074 and above.
Affected products
- Secomea GateManager 11.5.0, 11.4.625515072
Timeline
- 2026-09-15: disclosed