External risk intelligence

CAT Session Cookie Forgery via Unkeyed Hashcode Checksum.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85181

The product is a web-based application (CAT) that manages sessions and authentication. Such systems are commonly deployed as web-facing portals or monitoring dashboards, making them reachable via the internet in many deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the CAT application allows attackers to forge session cookies, potentially bypassing authentication and gaining administrative access to the system. The core issue stems from how session integrity is checked, enabling unauthorized individuals to manipulate requests and elevate their privileges.

Attackers can forge session cookies.
Essential to verify if CAT is deployed.
Focus on validating product relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can impersonate a legitimate user, including administrators, by forging session cookies. This is achieved by exploiting how the application validates session integrity and by bypassing network-level access controls through manipulation of HTTP headers, ultimately granting them full system control.

Attacker needs network access.
Attacker sends crafted HTTP request.
Full administrative access gained.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to impersonate an administrator by forging session cookies, leading to unauthorized access and full configuration control over the affected system. This is possible when an attacker can intercept or manipulate network traffic and send specially crafted requests.

System configuration and administrative access.
Forging session cookies via HTTP headers.
Unauthorized administrative control of the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CAT allows for session cookie forgery by manipulating the `x-forwarded-for` header, potentially granting administrative access. Identifying all deployments of CAT, confirming their exposure and criticality, and locating the accountable owners are the immediate priorities. Remediation planning should then follow based on the assessed risk.

Application owners should manage the issue.
Verify CAT instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the CAT application?

CAT (Central Application Tracking) is an open-source performance monitoring platform used by developers to track application metrics, logs, and transaction traces. It functions as a centralized dashboard to observe system health and distributed service performance, often requiring persistent user sessions for teams to manage these critical monitoring configurations.

What does CWE-565 mean for CVE-2026-85181?

CWE-565 refers to reliance on a component that does not provide sufficient integrity protection. In this CVE, the software uses a simple Java hashCode to verify session cookies. Because this hash is not protected by a secret server-side key, it is predictable. An attacker can easily calculate the correct checksum offline to forge a valid session cookie, effectively impersonating any user, including administrators, without needing a legitimate password.

How does an attacker trigger this vulnerability?

An attacker triggers this by crafting a malicious HTTP request that includes a forged session cookie. They can also manipulate the x-forwarded-for header in the same request to bypass IP-based security checks that the system relies on for authentication. Simply browsing the site normally does not trigger the bug; it requires the active submission of these specifically crafted, unauthorized headers and cookies.

Is my CAT instance at risk?

According to Halo Surface Signal, your risk is elevated if your CAT instance is a web-facing portal reachable via the internet. Because the vulnerability allows for unauthenticated administrative access, any deployment exposed to external network traffic is a primary concern. Instances restricted strictly to internal, private networks are less immediately reachable, though they remain vulnerable to anyone with existing network access.

What should I do first to address this?

Start by identifying every CAT instance running in your environment to understand your total footprint. Once you have an inventory, determine which instances are accessible from the internet versus those on internal networks. Communicate the risks to the specific owners of these applications so they can prioritize the systems that require urgent configuration changes or access restrictions to mitigate the potential for unauthorized administrative access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.