CVE-2026-5085: Mcrawfor Solstice::session vulnerability (CVSS 9.1)

Description

Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id. The same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution. The epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers. Predictable session ids could allow an attacker to gain access to systems.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Mcrawfor Solstice::session\

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

https://metacpan.org/dist/Solstice/source/lib/Solstice/Session.pm#L481Product
https://metacpan.org/dist/Solstice/source/lib/Solstice/Subsession.pm#L105Product
https://security.metacpan.org/docs/guides/random-data-for-security.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/13/2Mailing List

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-5085 being actively exploited?

CVE-2026-5085 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.53%.

How severe is CVE-2026-5085?

CVE-2026-5085 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.53% probability of exploitation.

Which products are affected by CVE-2026-5085?

Affected products include Mcrawfor Solstice::session.

How do I fix CVE-2026-5085?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-5085 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo