CVE-2026-24352 - Vulnerability Analysis

Overview

PluXml CMS 5.8.21 and 5.9.0-rc7 contain a session fixation vulnerability caused by allowing session ID to be set before authentication and retained after login, letting attackers hijack authenticated sessions, exploit requires victim to authenticate with fixed session ID.

Severity & Score

Impact

Attackers can hijack authenticated user sessions, gaining unauthorized access to victim accounts.

Mitigation

Update to the latest version where session fixation is fixed.

References

• https://cert.pl/posts/2026/03/CVE-2026-24350
• https://pluxml.org/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🔴 CVE-2026-24352 - Critical (9.8) PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24352/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner