Is there a patch available for CVE-2026-66745?

Yes, a patch is available for CVE-2026-66745. Update the affected software to the latest version immediately.

PHP CVE-2026-66745

Q: What is the CVSS score of CVE-2026-66745?

CVE-2026-66745 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49955 HIGH

Code Injection (CWE-94)

2026-07-28 VulnCheck

GHSA-48r5-qhcj-7g87

PHP RCE Code Injection Artica Proxy Articatech

7.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 18:50 vuln.today

CVE Published

Jul 28, 2026 - 18:10 cve.org

HIGH 7.5

DescriptionCVE.org

Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the attacker gains a fully authenticated administrative session on port 9000.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - Jul 29, 2026

AnalysisAI

We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field.

First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory.

Now we need to fill fields.

product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes.

summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h