Topic

Session Hijacking: news, advisories and analysis

13 articlesUpdated 12 Oct 2026

CyberSecureToday covers Session Hijacking across 13 articles published between 2 Sep 2026 and 12 Oct 2026. The coverage includes 10 vulnerability advisories, 1 incident or breach report and 1 analysis or guidance piece. 10 advisories are rated critical or high severity, and 2 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Session Hijacking most often intersect with Cloud Security, CWE-79 and CWE-287, with Technology, Cloud & SaaS the most affected sector. The most recent story, “AWS S3 Express One Zone Flaw Allowed Session Token Reuse Across Enclaves”, was published 12 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
AWS S3 Express One Zone Flaw Allowed Session Token Reuse Across Enclaves
AWS resolves security flaw CVE-2026-75210 in S3 Express One Zone storage class, addressing a session token reuse bug across high-performance compute enclaves.
CST Editorial Desk12 Oct 20268 min read
NewsCloud & SaaS
Semiconductor Maker's Data Exfiltration Traced to Hijacked Okta SSO Tokens
SEC Form 8-K disclosure details a major semiconductor intellectual property theft incident initiated via corporate SSO session token hijacking.
Daniel Okafor7 Oct 20268 min read
Cyber AttackGov & Defence
China-Aligned TA419 Impersonates White House and Anthropic Figures to Target AI Experts
Proofpoint: China-aligned TA419 posed as an ex-White House OSTP official and an Anthropic employee to steal AI policy experts' Microsoft 365 sessions.
Daniel Okafor3 Oct 20266 min read
ThreatsCloud & SaaSCritical
SUSE Rancher Flaw Lets Unauthenticated Attackers Plant Login-Page Script and Seize Kubernetes Fleets (CVE-2026-88804)
SUSE Rancher CVE-2026-88804 (CVSS 9.6) lets unauthenticated attackers rewrite UI settings, plant login-page script and take over managed Kubernetes clusters.
Aisha Noor3 Oct 20265 min read
ThreatsCloud & SaaSCritical
Zammad Enterprise Helpdesk Session Hijacking Vulnerability Leads to Unauthenticated Remote Code Execution (CVE-2026-102489)
An authentication bypass in Zammad helpdesk versions 6.3.0–6.5.4 allows remote attackers to hijack administrative sessions and achieve remote code execution.
Priya Raman1 Oct 202611 min read
ThreatsCloud & SaaSCritical
OpenBSD ldapd Asynchronous Response Race Allows Unauthorized Directory Session Hijacking (CVE-2026-103547)
A race condition in OpenBSD ldapd delegated authentication allows remote attackers to hijack directory sessions and impersonate arbitrary user identities.
CST Editorial Desk1 Oct 202611 min read
ThreatsCloud & SaaSCritical
Fortinet FortiPAM Authentication Bypass Enables Remote Session Hijacking and Traffic Proxying
Fortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.
Daniel Okafor25 Sep 202618 min read
ThreatsIndustrial & OTHigh
OpenPLC Runtime Stored XSS Flaw Enables Operator Session Hijacking and Unauthorized Physical Process Control CVE-2026-88020
CISA warns of CVE-2026-88020 in OpenPLC Runtime v3 web interface, allowing attackers to hijack operator sessions and manipulate physical industrial processes.
CST Editorial Desk23 Sep 202615 min read
ThreatsIndustrial & OTHigh
Siemens Teamcenter Authentication Redirect Flaw Exposes Industrial PLM Blueprints to Session Hijacking CVE-2026-58113
Siemens and CISA issue advisory ICSA-26-258-07 for CVE-2026-58113 in Teamcenter PLM, where reflected XSS in authentication redirects allows remote attackers to hijack CAD sessions.
CST Editorial Desk22 Sep 202615 min read
ThreatsCloud & SaaSHigh
Apache Tomcat Session Data Exposure Flaw Weaponized in Credential Hijacking Attacks
CISA flags Apache Tomcat vulnerability CVE-2026-34486 exploited in enterprise intrusions to intercept unencrypted session tokens and hijack authenticated user access.
Daniel Okafor16 Sep 202610 min read
ThreatsCloud & SaaSHigh
Fortinet FortiOS SSL-VPN Sensitive Information Disclosure Flaw CVE-2025-68686 Actively Targeted for Initial Access
CISA updates KEV with CVE-2025-68686, a critical information disclosure vulnerability in Fortinet FortiOS exploited to harvest active VPN session tokens.
CST Editorial Desk16 Sep 20269 min read
InsightsCloud & SaaS
MFA failed in 84% of incident responses. The problem is the session, not the factor
With 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Aisha Noor6 Sep 20267 min read
ThreatsBanking & FintechHigh
One AiTM phishing campaign compromised 35,000 users across 13,000 organisations in three days
Adversary-in-the-middle phishing now defeats standard MFA at industrial scale. Microsoft tracked a single April 2026 campaign spanning 26 countries in 72 hours.
Aisha Noor2 Sep 20267 min read