Quick answers
- Is CVE-2026-85238 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85238 being exploited in the wild.
- How severe is CVE-2026-85238?
- Medium severity, with a CVSS score of 6.8, published 3 September 2026.
- Which products and versions are affected?
- Misp <UNKNOWN>.
- Is there a fix for CVE-2026-85238?
- A patch was published on 2026-09-03: Commit e2eb2f0 restores session rotation on CustomAuth authentication Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85238 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-85238?
- Check whether you run Misp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a session fixation vulnerability in MISP's CustomAuth authentication flow. The root cause is that the __customAuthentication() function stores the authenticated user identity in the existing CakePHP session without rotating the session identifier, as the call to Session->renew() was previously disabled. An attacker can force a victim to use a known session identifier before authentication; after successful authentication through CustomAuth, that same identifier remains valid and can be reused by the attacker. The attack is network-accessible and requires no victim interaction beyond normal authentication. The patch restores session identifier rotation on new authentication or when the authenticated user changes, while avoiding unnecessary renewal on every request.
Affected products
- MISP MISP <UNKNOWN>
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Commit e2eb2f0 restores session rotation on CustomAuth authentication