CVE-2026-3269: 
Java vulnerability analysis and mitigation

CVE-2026-3269 is a broken access control vulnerability in PSI Probe (a Tomcat management application) that allows any authenticated low-privileged user to forcibly terminate arbitrary user sessions, resulting in a denial of service condition. It affects PSI Probe versions up to and including 5.3.0, specifically the handleRequestInternal function in ExpireSessionsController.java. The vulnerability was disclosed on February 26–27, 2026, with a proof-of-concept exploit published at the time of disclosure; the vendor did not respond to early contact. CVSS v3.1 base score is 6.5 (Medium) per NVD, while the CNA (VulDB) rates it 4.3 (Medium) (GitHub Advisory, NVD).

The root cause is improper authorization (CWE-285) combined with improper resource shutdown or release (CWE-404) in the ExpireSessionsController.java file within the Session Handler component. The vulnerable handleRequestInternal() function processes bulk session expiration requests at the /app/expire_list.htm endpoint by iterating over sid_webapp parameters and calling session.expire() without verifying whether the requesting user owns the target sessions or holds administrative privileges — only the basic probeuser role is checked. An attacker can supply arbitrary session IDs belonging to other users via repeated sid_webapp parameters in a single POST request, and the application will terminate all specified sessions without further authorization checks. There is no limit on the number of sessions that can be terminated in a single request, amplifying the denial-of-service impact (GitHub PoC, GitHub Advisory).

Successful exploitation allows an authenticated attacker with only the low-privileged probeuser role to forcibly log out multiple users across different web applications managed by Tomcat in a single HTTP request, causing widespread denial of service. There is no confidentiality or integrity impact on data, but availability is significantly affected — administrators and end users can be continuously prevented from maintaining active sessions, potentially paralyzing operational teams and disrupting critical administrative functions. Combined with session enumeration via the /sessions.htm endpoint, an attacker could systematically target all active users, forcing mass re-authentication and potentially overwhelming authentication systems (GitHub PoC).

A proof-of-concept exploit was publicly published at the time of disclosure (February 2026) on GitHub, demonstrating both manual HTTP request crafting and an automated Python script for harvesting and terminating all active sessions (GitHub PoC). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (very low probability of exploitation in the next 30 days) (GitHub Advisory). No threat actor attribution has been reported.

1. Obtain credentials: Acquire valid credentials for a PSI Probe account with the probeuser role — the minimum privilege level required.
2. Enumerate active sessions: Authenticate to PSI Probe and send a GET request to /sessions.htm to retrieve a list of active session IDs and their associated web applications.
3. Identify target sessions: From the session list, collect session IDs belonging to other users (excluding the attacker's own session to avoid self-lockout).
4. Craft bulk expiration request: Construct a POST request to /app/expire_list.htm with multiple sid_webapp parameters, each formatted as <sessionId>;<webappContext> (e.g., sid_webapp=ABC123;/manager&sid_webapp=DEF456;/myapp).
5. Submit the request: Send the crafted POST request with Basic authentication. The server processes all specified sessions and calls session.expire() on each without ownership validation, immediately logging out all targeted users.
6. Repeat for continuous DoS: Automate steps 2–5 in a loop to continuously terminate newly created sessions, preventing users from maintaining active sessions (GitHub PoC).

• Network: Repeated POST requests to /app/expire_list.htm from a single low-privileged account, especially with large numbers of sid_webapp parameters; unusual volume of session expiration activity in a short time window.
• Logs: Tomcat/PSI Probe access logs showing frequent POST requests to /app/expire_list.htm by a probeuser-role account; multiple session expiration events logged in rapid succession across different web applications.
• Application Behavior: Unusual spike in forced logouts or session invalidations across multiple deployed web applications; users reporting unexpected session terminations or forced re-authentication events.
• Audit Trail: GET requests to /sessions.htm immediately followed by POST requests to /app/expire_list.htm from the same source IP, indicating session enumeration followed by bulk termination (GitHub PoC).

Upgrade PSI Probe to a version newer than 5.3.0, which addresses this broken access control issue; as of the advisory date, no specific patched version number was listed in the GitHub Advisory (patched versions field shows "None"), so monitor the PSI Probe repository for a fix release (GitHub Advisory). As an immediate workaround, restrict access to PSI Probe — particularly the /app/expire_list.htm endpoint — to trusted administrators only, using network-level controls or web server access restrictions. Additionally, limit the probeuser role to only trusted personnel, implement rate limiting on bulk operation endpoints, and monitor for unusual session expiration activity as described in the IOCs section (GitHub PoC).

The vulnerability was assigned by VulDB and noted that the vendor (PSI Probe maintainers) did not respond to early disclosure contact, which was flagged in the advisory description. Red Hat tracked the CVE via their security advisory system. No significant public researcher commentary, vendor statements, or notable media coverage beyond standard vulnerability database entries has been identified (NVD, Red Hat Advisory).