Articatech
Monthly
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy 4.30.000000. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy before 4.30.000000. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields, using these credentials at. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy 4.30.000000. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy CE before 4.28.030.418. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Artica Proxy before 4.30.000000. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields, using these credentials at. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.