Quick answers
- Is CVE-2026-87930 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87930 being exploited in the wild.
- How severe is CVE-2026-87930?
- High severity, with a CVSS score of 8.1, published 9 September 2026.
- Which products and versions are affected?
- MaxSite CMS through 109.6.
- Is there a fix for CVE-2026-87930?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-87930 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-87930?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
MaxSite CMS contains a multi-stage vulnerability chain: (1) a hardcoded encryption key ('encryption key') used for HMAC-SHA1 signing of session cookies, allowing attackers to forge valid ci_session cookies with arbitrary content; (2) unsafe unserialize() calls in Session.php:742 and other locations that lack the ['allowed_classes' => false] guard, enabling PHP object injection; and (3) database re-validation logic that accepts malformed ciphertext (which decrypts to boolean false) and converts it to SQL integer 0, bypassing authentication checks via string-to-integer type coercion. Attack requires no authentication or user interaction. An attacker can forge an admin session cookie or inject malicious serialized objects; if gadget classes exist in deployed dependencies, arbitrary code execution is possible. Patches should replace all unserialize() calls with safe equivalents and fix the database validation logic.
Affected products
- MaxSite CMS through 109.6
Timeline
- 2026-09-09: disclosed: CVE-2026-87930 published; advisory disclosed