CVE-2026-9507 is a session fixation vulnerability in Enhancesoft osTicket version 1.18.2. The flaw occurs because the application does not invalidate the pre-authentication session cookie or generate a new session identifier after a user successfully logs in. This allows an attacker who can set a known session ID in a victim's browser prior to login to maintain unauthorized access to the victim's account post-authentication. The vulnerability is classified under CWE-38 (Path Traversal) but the core issue is session fixation. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed.

An attacker who can set a session identifier in a victim's browser before login can hijack the victim's authenticated session, gaining unauthorized access to the victim's account. This compromises account confidentiality and integrity. There is no indication of privilege escalation or system-wide impact beyond the affected user account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor Enhancesoft's advisories for updates. Until a fix is available, consider implementing additional session management controls such as forcing session ID regeneration upon login as a temporary mitigation if possible.