CVE-2026-92609
CVE-2026-92609: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical9.8
Critical [CVE-2026-92609] Apache Qpid Broker-J: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication
CVE-2026-92609Source published Source updated
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.
- Affected products in this advisory
- Apache Qpid Broker-J
- Source-reported affected versions
- through 10.1.0
- Source-reported fixed versions
- 10.1.1
- Mitigation guidance
- Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-92609] org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation
CVE-2026-92609Source published Source updated
org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-613. Affected product named by the advisory: Red Hat Fuse 7.
- Related products — impact not confirmed
- Red Hat Fuse 7
- Source-reported affected versions
- 10.1.0
- Source-reported fixed versions
- 10.1.1
- Mitigation guidance
- Restrict access to the HTTP management port to trusted administrative hosts or localhost: 1. Limit management port access using `firewalld` to allow only authorized administrative IP addresses: ``` firewall-cmd --permanent --zone=trusted --add-source=<ADMIN_IP> firewall-cmd --reload ``` Alternatively, configure the broker management HTTP connector to bind exclusively to localhost (`127.0.0.1`), or restrict external reachability using perimeter network controls. 2. Caveats: Restricting access to the HTTP management interface will block administrative connections originating outside designated trusted networks or hosts. Warning: Modifying firewall rules and reloading the firewall configuration may temporarily interrupt active network connections.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.