PHP CVE-2026-35185

Remote unauthenticated exploitation against default configurations of HAXiam/HAX CMS prior to version 25.0.0. The vulnerable /server-status endpoint is publicly accessible by default without requiring authentication, special configuration, or enabled features. Attack surface is limited only by network accessibility - installations behind corporate firewalls or VPNs with no external internet exposure have reduced risk. No user interaction (UI:N) or privilege level (PR:N) required. The primary limiting factor is internet reachability of the HAX CMS installation; internal-only deployments with proper network segmentation are not exploitable from external threat actors.

CVSS 8.7 (High) reflects the severe integrity impact from token exposure, though real-world exploitation risk appears moderate based on converging signals. The CVSS vector shows trivial exploitation (network vector, low complexity, no authentication, no user interaction), making this highly automatable for reconnaissance. However, EPSS 0.06% (19th percentile) indicates minimal observed scanning activity, suggesting attackers have not widely targeted this endpoint. No CISA KEV listing confirms absence of reported active exploitation in federal enterprise environments. The SSVC framework assessment: Exploitation=none (no public POC identified), Automatable=yes (trivial HTTP GET request), Technical Impact=partial (token theft enables session hijacking but requires subsequent exploitation). Primary risk is credential harvesting enabling authenticated attacks against HAX CMS installations, though the attack requires exposed installations and subsequent token utilization. The low EPSS despite high CVSS suggests either limited HAX CMS deployment footprint or insufficient attacker awareness. Organizations running internet-facing HAX CMS instances should prioritize patching, while internal-only deployments face reduced immediate risk if network access is properly segmented.

An external attacker performs reconnaissance scanning for HAX CMS installations and identifies exposed /server-status endpoints through automated HTTP probing. By accessing this endpoint without authentication, the attacker retrieves active user_token values for currently logged-in administrators. Using these harvested tokens, the attacker hijacks authenticated sessions to modify site content, inject malicious code into managed microsites, or access sensitive user data within the HAX CMS platform. The exposed IP addresses and server configuration details further enable targeted attacks against the underlying infrastructure.