CVE-2026-12581: Digiwin｜EasyFlow .NET - Session Fixation

Published Jun 22, 2026

Updated

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.

Affected Software

1 affected component

Digiwin EasyFlow .NET

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Digiwin EasyFlow .NET to a version that resolves this vulnerability.
Fixed in 8.1.5

Event History

Jun 22, 2026

CVE Published

via MITRE·09:30 AM

Data Sourced

via MITRE·09:30 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-12581?

The severity of CVE-2026-12581 is high with a CVSS score of 7.5.

How do I fix CVE-2026-12581?

To fix CVE-2026-12581, ensure that session IDs are securely generated and validated to prevent session fixation.

What types of attacks are possible exploiting CVE-2026-12581?

Exploiting CVE-2026-12581 allows unauthenticated remote attackers to hijack user privileges by replacing session IDs.

Which software is affected by CVE-2026-12581?

The affected software for CVE-2026-12581 is Digiwin EasyFlow .NET.

What should users do if they are using Digiwin EasyFlow .NET?

Users of Digiwin EasyFlow .NET should apply security patches or updates as they become available to mitigate CVE-2026-12581.