Vulnerability · medium · CVSS 5.9
CVE-2026-74762: Apache Shiro possible session fixation with RememberMe
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Apache Shiro applications using RememberMe before version 3.0.1
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
What to do
- Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
- Check whether shiro-web is affected using the version list in the advisory
The Brief
- CVE-2026-74762 is a possible session fixation issue in Apache Shiro's RememberMe feature.
- The source rates it CVSS 4.0 5.9 (medium).
- The source lists org.apache.shiro:shiro-core before 3.0.1 as affected.
Why it matters
Developers running affected Apache Shiro versions with RememberMe should check their dependency versions and upgrade to a fixed release.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build applications with. |
| No | Core infrastructure | Judgment: a single Java framework, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Shiro is a widely used Java framework across many teams. |
| No | Exploited in the wild | Open Source Security advisory: lists CVSS severity and affected versions only, no reported attacks. |
| No | Public exploit | Open Source Security advisory: describes the flaw and severity, no exploit code or PoC mentioned. |
| Yes | Remote, no login | Open Source Security advisory: CVSS vector AV:N/PR:N, network attack without privileges. |
| No | Full takeover | Open Source Security advisory: session fixation with CVSS VI:L, VA:N; no code execution or admin takeover stated. |
| No | Secrets exposed | Open Source Security advisory: describes a session fixation flaw; no stolen or exposed data reported. |
| No | Supply chain | Open Source Security advisory: a vulnerability in Shiro code, no malicious code shipped through a trusted channel. |
| No | No fix yet | Open Source Security advisory: affected versions are before 3.0.1, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
CVE-2026-74762 posted to oss-sec by Lenny Primak
Open Source Security
CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe
Source
CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided