Apache Qpid Broker-J CVE-2026-92609

Requires the HTTP management interface of Apache Qpid Broker-J (versions through 10.1.0) to be reachable by the attacker, and requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login. Exploitation is limited by this need for victim authentication (effectively user interaction) and by the requirement that the attacker influence or predict the pre-authentication session identifier; it does not affect brokers where management access is otherwise restricted or where 10.1.1 has been applied.

NVD scores this 9.8 CRITICAL with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but that vector is inconsistent with the vulnerability class. CWE-384 session fixation does not grant standalone remote code execution or direct unauthenticated takeover - it requires a legitimate management user (typically an administrator) to authenticate while using a session identifier the attacker planted or knows. That dependency implies UI:R and AC:H in practice, not UI:N/AC:L, so the true severity is closer to HIGH (~7.1) than the headline 9.8. Exploitation signals are otherwise weak: no CISA KEV listing, no EPSS score provided, and no public exploit code identified in the references. This is a real, patchable authentication weakness worth remediating, but the 9.8 rating overstates the ease of attack; the CVSS complexity/UI metrics conflict with the session-fixation mechanic described and should be treated with skepticism. Net priority is moderate - driven more by the sensitivity of broker management access than by likelihood of mass exploitation.

An attacker obtains or fixes a session identifier on the Qpid Broker-J HTTP management interface and induces an administrator to authenticate while that identifier is in force (e.g., via a crafted link or shared/predictable session token). Because the broker retains the same session identifier across successful login rather than issuing a fresh one, the attacker reuses it to inherit the administrator's authenticated management session. No public exploit code was identified at the time of analysis.