CVE-2026-5085

OVERVIEW CVE-2026-5085 is a session identifier generation vulnerability in Solstice::Session versions through 1440 for Perl. The _generateSessionID method produces cryptographically weak session IDs by combining predictable inputs including epoch time, stringified hash references, insufficiently-seeded random numbers, and process IDs. The same flawed method is reused in the Solstice::Subsession component within the same distribution. SEVERITY This vulnerability has a CVSS 3.1 score of 9.1 CRITICAL with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The threat actors can potentially obtain high-impact confidentiality and integrity breaches by predicting valid session identifiers and impersonating legitimate users. The predictable nature of all seed values—particularly the 16-bit random seeding and guessable epoch time—makes session hijacking feasible without special privileges. EXPLOITATION STATUS There is no evidence of active exploitation in known exploit databases or vulnerability feeds. The vulnerability does not appear on CISA's KEV catalog, indicating no confirmed real-world attacks have been documented. Community attention remains minimal as reflected by the low EPSS score of 0.0004. However, the severity warrants urgent patching of affected Solstice installations given the straightforward nature of the vulnerability and potential for simple exploit development.