CVE-2014-9386: Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier f...

Security readout for executives and security teams

CVE-2014-9386 is a session-management flaw in Zenoss Core before 4.2.5 SP161. The application set the session ID cookie with an effectively infinite lifetime, so a session could remain usable longer than expected. This increases the risk of account takeover if an attacker can access or reuse a session from an unattended workstation. Organizations running Zenoss Core versions earlier than 4.2.5 SP161 are potentially exposed, especially where administrative consoles remain logged in on shared, unlocked, or poorly managed workstations. Treat this as a moderate priority for legacy Zenoss environments. It is most urgent where Zenoss has privileged operational access and administrators use shared or unattended workstations. Mitigation focus: Upgrade Zenoss Core to 4.2.5 SP161 or later where vendor guidance supports it.; Review vendor guidance for any additional session-management remediation.; Invalidate existing sessions after remediation..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.