EUVD-2026-49955
GHSA-48r5-qhcj-7g87
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field.
First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory.
Now we need to fill fields.
product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes.
summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Artica Proxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the attacker gains a fully authenticated administrative session on port 9000.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Artica Proxy
View allThe Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users
Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy servi
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. Rated cr
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name,
Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated high severity (CVSS 7.5), this vulnerability is re
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parame
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/setting
An issue was discovered in Artica Proxy 4.30.000000. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated medium severity (CVSS 6.1), this vulnerability is
Exploit-DB