Is CVE-2026-86279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86279 being exploited in the wild.

How severe is CVE-2026-86279?

Medium severity, with a CVSS score of 6.3, published 7 September 2026.

Is there a fix for CVE-2026-86279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86279 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86279?

Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86279: SourceCodester Syllabus-Aligned Learning Management System session fixation in auth_process.php

CVE-2026-86279 · Severity: medium · CVSS 6.3 · Published 2026-09-07

The Syllabus-Aligned Learning Management & Examination System is a web-based platform used for managing course syllabi and student assessments. A session fixation vulnerability in the login component allows an attacker to hijack user sessions and gain unauthorized access to student or instructor accounts without requiring valid credentials.

Technologies: SourceCodester Syllabus-Aligned Learning Management & Examination System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-86279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86279 being exploited in the wild.
How severe is CVE-2026-86279?: Medium severity, with a CVSS score of 6.3, published 7 September 2026.
Which products and versions are affected?: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0.
Is there a fix for CVE-2026-86279?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86279 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86279?: Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a session fixation flaw in the auth_process.php login component that fails to regenerate session identifiers after successful authentication. An attacker can force a victim to use a known session token, then leverage that same token to impersonate the victim after they log in. The attack is remotely accessible without authentication. Related issues include incomplete authorization checks, missing session destruction on logout, no session timeout enforcement, and missing secure cookie flags. No patch information is currently available for version 1.0.

Affected products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0

Timeline

2026-09-07: disclosed: Publicly disclosed vulnerability report
2026-09-07: advisory: CVE-2026-86279 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.