Secomea GateManager EUVD-2026-78410

Exploitation requires three concrete things in combination: (1) the GateManager webserver module must be reachable by the attacker (the CVSS AV:N metric confirms a network path, and the session-fixation primitive hinges on the attacker being able to plant or observe a session identifier); (2) a victim with valid GateManager credentials must then authenticate using the attacker-supplied session ID, which is the UI:R requirement and the single biggest limiting factor - an unattended appliance cannot be compromised by this technique alone; and (3) the deployment must be running an affected build, i.e. 11.5 or 11.4.625515072 and below the fixed versions, since 11.6 and 11.4.626194074 regenerate the session ID and close the window. Authentication is not required for the attacker (PR:N), but it is required for the victim, so success depends on user behaviour (phishing, malicious links, or a shared/untrusted browser). Limiting factors: the attack cannot be automated against arbitrary hosts without a logged-in victim, it does not by itself require any non-default feature toggle to be enabled, and hardening that isolates the web UI from untrusted networks removes the delivery path entirely.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L describes a network-reachable flaw that needs no credentials but does depend on a victim completing a login (UI:R), with high confidentiality and integrity impact and a partial availability impact - a realistic recipe for full administrative takeover of a remote-access appliance. The compensating good news is that no CISA KEV entry, no EPSS score and no public exploit code were supplied, so this is currently a patch-priority issue rather than a confirmed active-exploitation fire; the real driver is that GateManager often carries a broad OT attack surface, so even a mid-sized municipal IT team in tczew should treat this as urgent once their internet-exposed GateManager instance is identified. Caveats worth stating explicitly: EPSS and patch-verification data are missing from the input, KEV absence is not evidence that exploitation has never occurred, and the UI:R requirement means mass scanning will not find exploitable targets the way an unauthenticated RCE would.

An attacker delivers a crafted link or embeds a request that sets a victim's GateManager session identifier to a value the attacker already knows - for example via a phishing email or a malicious page visited by an OT engineer - and waits for that engineer to authenticate against the GateManager web UI. Because the webserver module does not regenerate the session ID at login, the attacker simply replays the now-authenticated cookie over the internet and lands in the administrative console without ever knowing the credentials. No exploit code is known publicly, but the technique is low-complexity and needs only one successful user login to convert into full appliance control.