CVE-2026-2336

High

Description

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.

SeverityHigh

CVSS8.8

Exploit probability—

ProductMicrochip Istax

PublishedApr 16, 2026

First seenApr 16, 2026

Weakness typeCWE-331CWE-331

How to fix

Update

microchip istax2026.03 or later

Vendor advisories

microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/istax-privilege-escalation-via-weak-cookie-authentication

Affected products

Product	Affected versions	Fixed in
microchip istax	v < 2026.03	2026.03

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.