What’s Vulnerable › Vulnerabilities

CVE-2023-26261

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-08 · updated 2026-06-17
• Weakness: CWE-74

Description

In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.

Affected products

• Ubikasec Waap Cloud: before 6.11.0; before 6.5.6; 6.5.6 — fixed in 6.11.0, 6.5.6
• Ubikasec Waap Gateway: before 6.11.0; before 6.5.6; 6.5.6 — fixed in 6.11.0, 6.5.6

How to fix

Upgrade to a fixed version: Ubikasec Waap Cloud 6.11.0, 6.5.6; Ubikasec Waap Gateway 6.11.0, 6.5.6. Check the vendor advisory for mitigations.

References

• https://documentation.ubikasec.com/x/CQDAAw
• https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f
• https://documentation.ubikasec.com/x/CQDAAw
• https://gist.github.com/Jakick/7d1635b886654ddd0e476b3c79a7ba9f

Get alerted when CVE-2023-26261 or the next vulnerability affects your stack