CVE-2026-85181

CAT validates session cookies using only Java's String.hashCode() as an unkeyed integrity check (CWE-565), so anyone can compute a 'valid' checksum for an arbitrary cookie value offline. An unauthenticated network attacker can therefore craft a session cookie with a matching checksum and additionally supply an attacker-controlled x-forwarded-for header, which lets them pass the product's IP-binding validation. The result is a forged admin session with full configuration access, obtained without any credentials. Any network-reachable deployment of CAT that relies on this session-cookie mechanism is exposed; the available data does not specify a vendor or affected version range. No exploitation has been reported: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS currently estimates the 30-day exploitation probability at about 0.4% (31st percentile).

What to do: Restrict network access to the CAT interface to trusted management networks, and strip or overwrite attacker-controlled x-forwarded-for headers at trusted proxies so the IP-binding check cannot be bypassed. Check logs for admin sessions without corresponding authentication events or from unexpected source IPs. Apply the vendor's patched release when published; no fixed version is specified in the available data.