CVE-2026-92984

HighCVSS 8.1

Published: 17/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.

Risk Assessment

Possible hijacking of user accounts, including administrators, via session fixation attacks, leading to unauthorized access to data and system functions.

Recommendation

Update HUBzero CMS to a version later than 2.2.32 and enforce accepting session identifiers only from cookies.

Other vulnerabilities in HUBzero CMS

CVE-2026-92970High
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS