CVE-2026-75171

CriticalCVSS 9.8

Published: 04/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.

Risk Assessment

An attacker can gain higher privileges in the system, potentially leading to unauthorized access to sensitive data or full control over the application. The vulnerability can be used for further attacks.

Recommendation

It is recommended to update HubCore to a version that includes a fix for session cookie handling. Also, monitor logs for unusual privilege escalation attempts.

Other vulnerabilities in HubCore

CVE-2026-75170Medium
A cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.

Original NVD description (English source)

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.