CVE-2026-22617 describes a vulnerability in Eaton IPP software where sensitive cookies used in HTTPS sessions lack the 'secure' attribute. Without this attribute, cookies may be transmitted over unencrypted connections, exposing them to interception by network attackers. This vulnerability is classified under CWE-614. Eaton has addressed the issue in the latest software version available on their download center. The CVSS 3.1 vector indicates the attack requires network access with high complexity and privileges, and user interaction is required. The impact includes high confidentiality and integrity loss but no availability impact.

The vulnerability allows an attacker with network access to potentially intercept sensitive cookies due to the missing 'secure' attribute, which could lead to compromise of user session confidentiality and integrity. There is no indication of availability impact. The CVSS score of 5.7 reflects a medium severity, considering the required privileges and user interaction for exploitation.

A fix is available in the latest version of Eaton IPP software, which addresses the insecure cookie configuration by properly setting the 'secure' attribute. Users and administrators should upgrade to the latest version from the Eaton download center to remediate this vulnerability. No additional mitigation guidance is provided by the vendor advisory.