Which versions of Digiwin EasyFlow .NET are affected by CVE-2026-12581?

Digiwin EasyFlow .NET contains a session fixation vulnerability (CVE-2026-12581, CVSS 7.7) enabling unauthenticated attackers to hijack authenticated user sessions, potentially compromising…

How to fix or mitigate CVE-2026-12581?

Within 24 hours: Inventory all systems running Digiwin EasyFlow .NET; review application and web server logs for session anomalies or suspicious login patterns. Within 7 days: Implement session regeneration on login, enforce short session timeouts, enable IP pinning for session validation, and restrict administrative access to session management; contact Digiwin support for patched version timeline. Within 30 days: Deploy Digiwin EasyFlow .NET patched version immediately upon release; if no patch timeline emerges within 30 days, develop migration plan to alternative workflow automation platform.

Digiwin EasyFlow .NET CVE-2026-12581

Q: What is the CVSS score of CVE-2026-12581?

CVE-2026-12581 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38223 HIGH

Session Fixation (CWE-384)

2026-06-22 twcert

GHSA-456x-9xrh-6x87

Information Disclosure Session Fixation Easyflow Net

7.7

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable with no attacker auth (PR:N) but requires victim to use planted session and then log in, justifying AC:H and UI:R; full takeover yields C:H/I:H, no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 10:16 vuln.today

DescriptionCVE.org

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.

AnalysisAI

Session fixation in Digiwin EasyFlow .NET allows unauthenticated remote attackers to pre-set a victim's session identifier and hijack the authenticated session once the victim logs in, inheriting the victim's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.7 and HIGH impact across confidentiality, integrity, and availability mark this as a meaningful risk for organizations using the workflow platform. The flaw is tracked under CWE-384 and was disclosed via TWCERT, with no specific patched version cited in the provided references.

Technical ContextAI

EasyFlow .NET is a workflow/BPM platform from Taiwanese ERP vendor Digiwin, deployed widely across manufacturing and enterprise customers in the APAC region. The vulnerability falls under CWE-384 (Session Fixation), a class of weakness where the application accepts and continues to honor a session identifier that was supplied or known prior to authentication, rather than regenerating a fresh session ID upon successful login. In .NET web applications this typically arises when ASP.NET session cookies (ASP.NET_SessionId) or custom session tokens are not rotated on authentication transitions, leaving any pre-authentication session value bound to the user's post-authentication identity and authorization context.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; organizations should contact Digiwin directly and consult the TWCERT advisories at https://www.twcert.org.tw/en/cp-139-10981-8617d-2.html and https://www.twcert.org.tw/tw/cp-132-10980-0e640-1.html for the latest fixed build. As compensating controls, restrict EasyFlow .NET access to trusted networks via VPN or IP allowlisting to reduce the attacker's ability to plant session IDs (trade-off: less convenient for remote users), enforce HTTPS-only with the Secure and HttpOnly attributes on session cookies to limit cookie injection vectors (trade-off: requires TLS configuration validation), and where feasible configure ASP.NET to regenerate session identifiers on authentication via custom logout/login handling or IIS-level session pooling controls (trade-off: may require application-side changes and break existing user sessions on rollout).