CVE-2026-2336 Details

A privilege escalation vulnerability exists in Microchip IStaX versions prior to 2026.03. This vulnerability allows an authenticated low-privileged user to extract a shared per-device cookie secret from their webstax_auth session cookie. The user can then forge a new cookie that grants administrative privileges. The issue arises from the web management interface's cookie design, which inadvertently allows the derivation of reusable secrets that can be exploited to gain higher privileges.

Users are advised to upgrade Microchip IStaX to version 2026.03 or later, which addresses the vulnerability by modifying how authentication cookies are handled, preventing low-privileged users from deriving secrets and creating higher-privilege cookies.