External risk intelligence

MaxSite CMS Session Cookie Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-87930

The vulnerability affects a CMS, which is typically deployed as a public-facing web application. Since the issue involves session cookie handling accessible via the web interface, it is commonly reachable by anyone accessing the site over the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in MaxSite CMS affecting how it handles session cookies. This flaw allows unauthenticated attackers to inject malicious code by exploiting a predictable encryption key, potentially leading to the corruption of application data or full code execution. The main concern is to confirm if this CMS technology is in use and if it is exposed to the internet.

Unauthenticated code injection via session cookies.
Confirms use and external exposure of MaxSite CMS.
Assess impact and confirm relevance to our environment.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted session cookie to a vulnerable MaxSite CMS instance. The CMS then passes this cookie to an unserialize function without proper validation, allowing the attacker to inject malicious PHP objects. If the application has specific classes available, this could lead to corrupted application state or even remote code execution.

Accessible via the internet.
Unauthenticated session cookie manipulation.
Potential for code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect application state and potentially allow code execution on the server. This is possible when the system uses a hardcoded encryption key for session cookies and is vulnerable to insecure unserialization, allowing attackers to craft malicious session cookies to manipulate the application.

Server application state and code execution.
Via forged, insecurely unserialized session cookies.
Compromised server behavior or data integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability in MaxSite CMS likely impacts application owners responsible for web content management systems. Infrastructure or platform teams may also be involved if the CMS is part of a broader managed service. The initial practical step is to inventory all MaxSite CMS instances, verify their external reachability and business criticality, and identify the accountable system owner for each deployment to prioritize remediation efforts.

Application owners should take charge.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaxSite CMS?

MaxSite CMS is a content management system used to build and maintain websites. It provides the underlying framework for managing web content, user sessions, and application data, acting as the foundation for a site's digital presence.

What does CWE-502 mean for CVE-2026-87930?

CWE-502 refers to 'Deserialization of Untrusted Data.' In this CVE, the application takes a session cookie from a user and processes it without checking if the contents are safe. Because the software does not restrict which classes can be created during this process, an attacker can supply a specially crafted object that forces the application to perform unintended actions.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by creating a forged session cookie. Because the application uses a hardcoded encryption key, the attacker can sign the malicious cookie so the system accepts it as valid. Merely accessing the site normally or using legitimate features does not trigger the bug; it specifically requires the submission of a malicious, crafted cookie designed to exploit the unserialization process.

Is my site at risk if it uses MaxSite CMS?

If you use this software, you are potentially at risk. According to Halo Surface Signal, this vulnerability is particularly relevant to systems accessible via the internet because the session handling mechanism is reachable by anyone browsing the site. Internal-only instances still face risk from malicious actors who have gained access to your private network.

What should I do first to address this issue?

Start by identifying all instances of MaxSite CMS running in your environment. Confirm which of these are reachable from the internet and identify the specific business owner for each. Once you have a complete inventory, prioritize these assets to prepare for patching or configuration changes as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.