How severe is CVE-2026-43827?

CVE-2026-43827 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-43827 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-43827?

CVE-2026-43827 primarily affects Apache Shiro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-43827?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-43827 have an EU (EUVD) identifier?

Yes. CVE-2026-43827 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31736.

When was CVE-2026-43827 published?

CVE-2026-43827 was published on 2026-05-25 and last updated on 2026-06-17.

CVE-2026-43827

CVE-2026-43827 is a medium-severity vulnerability in Apache Shiro with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-384.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 5.9
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-31736
Weakness: CWE-384
Affected product: Apache Shiro
Published: 2026-05-25
Last modified: 2026-06-17

Description

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

Frequently asked questions

What is CVE-2026-43827?: Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
How severe is CVE-2026-43827?: CVE-2026-43827 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-43827 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-43827?: CVE-2026-43827 primarily affects Apache Shiro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-43827?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-43827 have an EU (EUVD) identifier?: Yes. CVE-2026-43827 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31736.
When was CVE-2026-43827 published?: CVE-2026-43827 was published on 2026-05-25 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:shiro:3.0.0:alpha1:*:*:*:*:*:*

More vulnerabilities in Apache Shiro

CVE-2023-34478 — Critical (CVSS 9.8): Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an…
CVE-2022-40664 — Critical (CVSS 9.8): Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via…
CVE-2022-32532 — Critical (CVSS 9.8): Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers.…
CVE-2021-41303 — Critical (CVSS 9.8): Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an…
CVE-2020-17523 — Critical (CVSS 9.8): Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an…
CVE-2020-17510 — Critical (CVSS 9.8): Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an…

All CVEs affecting Apache Shiro →

Other CWE-384 (Session Fixation) vulnerabilities

CVE-2024-11317 — Critical (CVSS 10.0): Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an…
CVE-2024-38513 — Critical (CVSS 10.0): Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a…
CVE-2021-20151 — Critical (CVSS 10.0): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's…
CVE-2025-67446 — Critical (CVSS 9.8): Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router…
CVE-2026-25101 — Critical (CVSS 9.8): Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same…
CVE-2026-24352 — Critical (CVSS 9.8): PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the…

Browse all CWE-384 (Session Fixation) vulnerabilities →