Amon2 CVE-2026-5082

This vulnerability presents a complex risk profile where traditional risk metrics diverge from practical exploitation likelihood. The CVSS score of 5.3 (Medium) with AV:N, AC:L, PR:N, UI:N reflects network-accessible session ID prediction without requiring authentication or user interaction. However, the EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability in real-world scanning data, suggesting either limited deployment of the affected versions, low attacker interest, or the technical complexity of exploitation not yet manifesting at scale. The SSVC framework assessment (Exploitation: none, Automatable: yes, Technical Impact: partial) is critical: while no active exploitation is known, the attack is automatable (an attacker can programmatically brute-force session IDs given knowledge of approximate creation time and PID ranges), and the technical impact is partial (session hijacking enables unauthorized actions within the scope of the user's session). The CISA KEV status does not list this CVE as actively exploited, and no public exploit code is confirmed in the provided data. Patch availability (version 7.04) further reduces urgency. This is a real vulnerability requiring remediation in production deployments, but is not an emergency-organizations should prioritize patching systems running versions 7.00-7.03, particularly those in high-value or sensitive contexts, but this is not a critical-priority incident.

An attacker targeting a web application using a vulnerable version of Amon2::Plugin::Web::CSRFDefender on a system without reliable /dev/urandom access can predict session IDs by enumerating likely PIDs (e.g., 1000-5000 on a typical system) and recent epoch timestamps (guessed or obtained from HTTP response headers). The attacker then crafts a request containing a guessed session ID and performs a CSRF attack or session hijacking by having a victim user's browser send the attacker's predicted session identifier, enabling the attacker to act as that user within the application. While the attack requires some reconnaissance and brute-force effort, SSVC confirms it is automatable, making it feasible for motivated threat actors or security researchers; however, the low EPSS score suggests this has not been widely weaponized.