CVE-2023-26261

UBIKA WAAP Gateway/Cloud through 6.10 has a blind XPath injection that leads to an authentication bypass by hijacking another connected user's session. Unauthenticated and remote, an attacker manipulates XPath processing to lift a valid session and step into an authenticated context. The uncomfortable detail, as with other appliances in this batch, is that WAAP is a web application firewall, the control meant to shield everything behind it.

Perimeter security appliances are internet-facing by design and implicitly trusted, which makes an unauthenticated auth-bypass on one especially valuable, defeating the gatekeeper hands an attacker whatever the appliance was protecting. Named, versioned flaws on such devices tend to be folded into scanning and intrusion toolkits quickly because the payoff is disproportionate. The 9.8 reflects a genuine full-access outcome with no precondition to speak of.

Our angle is exposure-driven urgency plus session-integrity thinking. We prioritize any UBIKA WAAP unit reachable from the internet for the upgrade to 6.11.0 or the 6.5.6-patch15 line, and because the exploit steals live sessions, we would treat existing sessions as suspect, invalidating them after patching and watching for anomalous authenticated activity that predates the fix.