Is CVE-2026-85181 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85181?

CVE-2026-85181 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-85181

Description

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.