CVE-2026-66745 Overview
CVE-2026-66745 is a session fixation vulnerability in Artica Proxy versions before 4.50.000000 Service Pack 7. The flaw resides in the fw.login.php authentication flow, which accepts attacker-supplied PHPSESSID cookies without regenerating the session identifier after successful login. An unauthenticated attacker can pre-set a known session identifier on a victim's browser and wait for the victim to authenticate. Once authentication completes, the attacker inherits a fully authenticated administrative session on port 9000.
Critical Impact
Successful exploitation grants attackers full administrative control over the Artica Proxy management console, exposing proxy configuration, network policies, and downstream traffic.
Affected Products
- Artica Proxy versions prior to 4.50.000000 Service Pack 7
- Artica Proxy administrative interface on port 9000
- Deployments missing hotfix 20260724-02
Discovery Timeline
- 2026-07-28 - CVE-2026-66745 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-66745
Vulnerability Analysis
The vulnerability stems from improper session management in the fw.login.php endpoint of Artica Proxy. The application accepts any PHPSESSID value presented by the client and binds authentication state to that identifier without rotating it after login. This behavior violates the session-regeneration principle expected after any change in privilege level. Session fixation attacks succeed because the application trusts pre-authentication session identifiers as post-authentication credentials. Attackers exploit this weakness to convert a controlled session token into an administrative session on port 9000. The classification aligns with session fixation patterns tracked under CWE-94 in the CVE record, though the behavior maps most directly to session fixation weaknesses.
Root Cause
The root cause is the absence of session identifier regeneration during authentication. When a user submits credentials to fw.login.php, the server elevates the privilege associated with the existing PHPSESSID rather than issuing a new one. Any party that knows the pre-authentication PHPSESSID value can therefore access the authenticated session state.
Attack Vector
An attacker first sets a chosen PHPSESSID cookie on the victim's browser through a cross-site scripting payload, a subdomain cookie injection, a phishing link that plants the cookie, or a network-position attack. The attacker then waits for the administrator to authenticate to the Artica Proxy console at port 9000 through fw.login.php. After the victim logs in, the attacker replays the same PHPSESSID value against the management interface. The server treats the attacker's request as the authenticated administrator and grants full console access.
No verified exploit code is publicly available. Refer to the VulnCheck Advisory on Artica Proxy for additional technical detail.
Detection Methods for CVE-2026-66745
Indicators of Compromise
- Multiple distinct source IP addresses using the same PHPSESSID cookie against port 9000 within a short window.
- Requests to fw.login.php where the client supplies a PHPSESSID value prior to any prior Set-Cookie from the server.
- Administrative actions in Artica Proxy logs originating from an IP that never completed an interactive login sequence.
Detection Strategies
- Alert on session identifier reuse across geolocations or user-agent strings targeting the Artica Proxy management interface.
- Correlate fw.login.php POST requests with prior GET requests that already carried a PHPSESSID, indicating a pre-set session.
- Monitor for administrative API calls on port 9000 that lack a preceding authentication event from the same source.
Monitoring Recommendations
- Ingest Artica Proxy access logs into a centralized analytics platform and baseline normal administrator session patterns.
- Track cookie lifecycle events for the management interface, flagging sessions that persist across authentication boundaries without rotation.
- Enable network capture on port 9000 to reconstruct suspect sessions during investigation.
How to Mitigate CVE-2026-66745
Immediate Actions Required
- Apply Artica Proxy hotfix 20260724-02 on all instances running versions before 4.50.000000 Service Pack 7.
- Restrict network access to port 9000 to trusted management networks only.
- Invalidate all existing administrative sessions and force re-authentication after patching.
- Rotate credentials for administrators who authenticated during the exposure window.
Patch Information
ArticaTech has released hotfix 20260724-02 that addresses the session fixation flaw in fw.login.php. Installation instructions are available in the ArticaTech Hotfix Documentation and the ArticaTech Hotfix Listing.
Workarounds
- Block direct external access to port 9000 using upstream firewall rules until the hotfix is applied.
- Require administrators to access the management interface exclusively over a VPN or bastion host.
- Instruct administrators to clear browser cookies before authenticating to the Artica Proxy console.
# Configuration example: restrict management port 9000 to a trusted subnet
iptables -A INPUT -p tcp --dport 9000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
