Patch Forecast
Amber warning
Patch this week.

CVE-2026-92609

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized…

Risk score
71/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version…
Affected
Apache Qpid Broker-j before 10.1.1
Fix
Upgrade Apache Qpid Broker-j to 10.1.1 or later.
Exploitation
No known exploitation

Story map

Story map: Apache Qpid Broker-jTHE FLAWSTHE FIXCVE-2026-92609Session fixation in HTTPmanagement authenticationallows remote attackers to…CVSS 9.8 · EPSS 0%CVE-2026-92550Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-92560Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-92564Denial of serviceCVSS 7.5 · EPSS 0%Upgrade Apache Qpid…10.1.1or later on your release lineWho is exposedApache Qpid Broker-j before10.1.1AMBER · PATCH THIS WEEKApache QpidBroker-jSession fixation in HTTPmanagement authenticationallows remote attackers to gainunauthorized access to anauthenticated managementsession via reuse of a sessionidentifier retained across…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-384 (CWE-384)12 other warnings in 30 days →Same productEarlier Apache Qpid Broker-j warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Qpid Broker-j: Amber, patch this week. Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version…

The flaws

  • CVE-2026-92609: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-92550: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-92560: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-92564: Denial of service (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Apache Qpid Broker-j: 10.1.1 or later on your release line

Who is exposed: Apache Qpid Broker-j before 10.1.1

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Last activity 25 Sep 2026. Patch Forecast updates every hour.