This vulnerability in Microchip IStaX involves an authenticated low-privileged user being able to extract a shared per-device cookie secret from their own webstax_auth session cookie. Using this secret, the attacker can forge a new cookie that grants administrative privileges, effectively escalating their access rights. The flaw is present in all versions of IStaX prior to 2026.03. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability is classified under CWE-331 (Insufficient Entropy).

An attacker with valid low-level authentication can escalate privileges to administrative level by forging session cookies, potentially gaining full control over the affected system. This compromises confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for suspicious activity related to session cookie manipulation.