High severity · published Sep 17, 2026
CVE-2026-92984
HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
hubzero-cms · hubzero
through 2.2.32 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92984
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92984
github.com
https://github.com/hubzero/hubzero-cms
github.com
https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Session/Manager.php#L123-L132
github.com
https://github.com/hubzero/hubzero-cms/commit/e60e8ebee5e1d38b1db1fc41bd9164b265b24356
www.vulncheck.com
https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-session-fixation-via-query-string-session-identifier
More from hubzero-cms
8.8
CVE-2026-92970
HUBzero CMS through 2.2.32 Path Traversal via File Upload