CVE-2026-35185

OVERVIEW CVE-2026-35185 affects HAX CMS versions prior to 25.0.0, a content management system that supports PHP and NodeJS backends. The vulnerability involves the /server-status endpoint being publicly accessible without authentication, which exposes sensitive information including user authentication tokens, real-time user activity logs, client IP addresses, and internal server configuration details. This information disclosure vulnerability allows any unauthenticated attacker to gather intelligence on active users and system infrastructure. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. While the attack has no impact on system integrity or availability, the confidentiality impact is high, making this primarily an information disclosure threat. The attack could enable secondary attacks by providing attackers with valid authentication tokens and detailed knowledge of the targeted infrastructure. EXPLOITATION STATUS The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation indicators, with an EPSS score of 0.000660000 indicating low prevalence in real-world attacks. Community attention appears minimal as reflected by the low FAUCET Risk Score of 38.0/100 and inactive status on security hot lists. However, organizations running HAX CMS versions before 25.0.0 should prioritize patching given the trivial attack requirements and the sensitive nature of exposed authentication credentials.