CVE-2006-3226

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-26 · updated 2026-06-16

Description

Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak Session Management Vulnerability."

Affected products

Cisco Secure Access Control Server: 4.0, 4.0.1

References

http://secunia.com/advisories/20816
http://securityreason.com/securityalert/1157
http://securitytracker.com/id?1016369
http://www.cisco.com/en/US/products/sw/secursw/ps2086/tsd_products_security_response09186a00806c68f9.html
http://www.osvdb.org/26825
http://www.securityfocus.com/archive/1/438161/100/0/threaded
http://www.securityfocus.com/archive/1/438258/100/0/threaded
http://www.securityfocus.com/bid/18621
http://www.vupen.com/english/advisories/2006/2524
https://exchange.xforce.ibmcloud.com/vulnerabilities/27328
http://secunia.com/advisories/20816
http://securityreason.com/securityalert/1157

Get alerted when CVE-2006-3226 or the next vulnerability affects your stack