CVE-2026-2336

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2336", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "state": "PUBLISHED", "assignerShortName": "Microchip", "dateReserved": "2026-02-11T10:30:26.167Z", "datePublished": "2026-04-16T17:02:06.352Z", "dateUpdated": "2026-04-16T17:34:39.672Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-04-16T17:02:06.352Z"}, "title": "Weak webstax_auth Cookie Authentication Allows Privilege Escalation", "datePublic": "2026-04-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-331", "description": "CWE-331 Insufficient entropy", "type": "CWE"}]}], "affected": [{"vendor": "Microchip", "product": "IStaX", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.03", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own <code>webstax_auth</code> session cookie and forge a new cookie with administrative privileges.<p>This issue affects IStaX before 2026.03.</p>"}]}], "references": [{"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/istax-privilege-escalation-via-weak-cookie-authentication", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H"}}], "workarounds": [{"lang": "en", "value": "Restrict access to the management interface to trusted networks and trusted users until devices can be upgraded.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Restrict access to the management interface to trusted networks and trusted users until devices can be upgraded."}]}], "credits": [{"lang": "en", "value": "Rickard Jonsson", "type": "finder"}], "source": {"advisory": "PSIRT-123", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T17:34:33.723469Z", "id": "CVE-2026-2336", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T17:34:39.672Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2336", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T17:34:33.723469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T17:34:36.932Z"}}], "cna": {"title": "Weak webstax_auth Cookie Authentication Allows Privilege Escalation", "source": {"advisory": "PSIRT-123", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Rickard Jonsson"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Microchip", "product": "IStaX", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.03", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2026-04-14T00:00:00.000Z", "references": [{"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/istax-privilege-escalation-via-weak-cookie-authentication", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Restrict access to the management interface to trusted networks and trusted users until devices can be upgraded.", "supportingMedia": [{"type": "text/html", "value": "Restrict access to the management interface to trusted networks and trusted users until devices can be upgraded.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.", "supportingMedia": [{"type": "text/html", "value": "A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own <code>webstax_auth</code> session cookie and forge a new cookie with administrative privileges.<p>This issue affects IStaX before 2026.03.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331 Insufficient entropy"}]}], "providerMetadata": {"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "shortName": "Microchip", "dateUpdated": "2026-04-16T17:02:06.352Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2336", "state": "PUBLISHED", "dateUpdated": "2026-04-16T17:34:39.672Z", "dateReserved": "2026-02-11T10:30:26.167Z", "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "datePublished": "2026-04-16T17:02:06.352Z", "assignerShortName": "Microchip"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "IStaX", "vendor": "Microchip", "versions": [{"lessThan": "2026.03", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microchip:istax:*:*:*:*:*:linux:*:*", "matchCriteriaId": "07011100-C40E-4CB3-B7BF-B3C725B509B9", "versionEndExcluding": "2026.03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios en Microchip IStaX permite a un usuario autenticado con bajos privilegios recuperar un secreto de cookie compartido por dispositivo de su propia cookie de sesi\u00f3n webstax_auth y forjar una nueva cookie con privilegios administrativos. Este problema afecta a IStaX anterior a 2026.03."}], "id": "CVE-2026-2336", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2336", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T17:34:33.723469Z", "version": "2.0.3"}}]}, "published": "2026-04-16T18:16:44.927", "references": [{"source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "tags": ["Broken Link"], "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/istax-privilege-escalation-via-weak-cookie-authentication"}], "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-331"}], "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.03)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "IStaX", "source": "cna", "vendor": "Microchip"}, "product": "istax", "vendor": "microchip"}], "analysis": {"en": {"generated_at": "2026-04-17T02:54:59.187948+00:00", "value": {"mitigation_remediation": ["Upgrade the device to IStaX version 2026.03 or later, which fixes the cookie authentication flaw.", "If an immediate upgrade is not possible, apply any vendor\u2011supplied patch that addresses the issue before it becomes publicized.", "Until a patch or upgrade is available, restrict the management interface to trusted networks and enforce access controls for trusted users, following the vendor\u2019s recommended workaround."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Devices running Microchip IStaX firmware dated before the 2026.03 release are affected. The vulnerability does not affect later releases that include the hardening of the cookie authentication mechanism.", "description_and_impact": "Microchip IStaX implements a per-device cookie secret that is stored in the webstax_auth session cookie. An authenticated low\u2011privileged user can retrieve this cookie secret from their own session cookie and use it to forge a cookie that grants administrative privileges. The vulnerability is a weakness of authentication enforcement (CWE\u2011331) and allows an attacker who has already authenticated to elevate privileges to administrator level, providing full control over the device. The impact is a clear loss of integrity and confidentiality of the device\u2019s configuration and data.", "risk_and_exploitability": "The CVSS score is 8.7, indicating a high severity vulnerability. While an EPSS score is not available, the lack of a KEV listing does not negate the risk; Microchip\u2019s recommendation to restrict management access until an upgrade suggests the risk of exploitation is considered significant. The likely attack vector is via the device\u2019s web management interface, meaning any party that can authenticate, even with low privileges, can leverage the flaw. Successful exploitation requires only a valid low\u2011privilege account and no special network infrastructure beyond access to the web interface."}}}}, "created": "2026-04-16T18:58:25.011071+00:00", "updated": "2026-04-17T03:00:08.456233+00:00", "vendors": ["microchip", "microchip$PRODUCT$istax"]}