CVE-2026-22617
Medium · 5.7CVSS
5.7
EPSS
0.2%
Published
Apr 16, 2026
CISA due date
—
The record
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614
- CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-614
- CVE-2025-52608 HCL iControl was affected by Missing Cookie Attributes vulnerability. CWE-614
- CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure`… CWE-614
- CVE-2026-43828 Default configurations of Apache Shiro send sensitive cookies in HTTPS session without… CWE-614