CVE-2026-24352 is a critical (CVSS 9.8) session fixation flaw in PluXml CMS. The session ID is set before login and does not change afterward. Versions 5.8.21 and 5.9.0-rc7 are confirmed vulnerable, and no fixed version is stated, so check the project for updates.
What's affected
The record says the reporter notified the vendor early, but the vendor did not reply with the details of the flaw or the vulnerable version range. Only 5.8.21 and 5.9.0-rc7 were tested and confirmed. Other versions were not tested and might also be vulnerable.
No fixed version is named in the record. The CERT Polska post linked from the record returned a not found error when I tried it, so check the PluXml site and changelog for the current state.
How to check if you're exposed
Find your PluXml version in the admin area or in the version file in your install, and compare it with the two confirmed versions. If you run any other release, treat it as possibly affected.
Also look at how sessions behave on your login page. A login that keeps the same session identifier before and after sign-in is the symptom. Use only your own site for that check.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Identify every PluXml install you run and its version.
- Check the PluXml changelog and site for a release that fixes session handling, and apply it.
- Until then, restrict access to the admin login to trusted networks, for example by IP allow list or VPN.
- Require everyone with an admin account to sign in again after you update.
- Consider moving off the software if the project stays unresponsive.
Why it matters
The weakness is CWE-384, session fixation. If a site keeps the same session ID before and after login, an attacker who can plant a known ID in a victim's browser can later use it as that user. The standard defense is to issue a fresh session ID whenever privilege changes, such as at login.
The record rates the impact as high for confidentiality, integrity and availability. The uncertainty here is about the version range, not about the weakness. It is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which versions are fixed?
The record does not name a fixed version. Check the PluXml site and changelog.
What stops session fixation in general?
Issuing a new session ID at login and invalidating the old one.
Sources
Last reviewed: 19 October 2026.
