CVE-2015-4138: The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3...

Security readout for executives and security teams

This issue affects the administrator WebUI cookie on specific Blue Coat SSL Visibility Appliance models. Older 3.6.x through 3.8.x releases before 3.8.4 did not mark that cookie as HTTPOnly, making it easier for script running in the browser to read sensitive administrator session data. Exposure is limited to organizations still running the listed Blue Coat SSL Visibility Appliance models on 3.6.x through 3.8.x before 3.8.4. Risk is higher where administrators access the WebUI from less-controlled browsers or management interfaces are broadly reachable. Treat this as a targeted legacy-appliance remediation item, not an emergency internet-wide event. Prioritize if these appliances are still deployed, especially where admin WebUI access is exposed beyond a tightly controlled management network. Mitigation focus: Upgrade affected appliances to version 3.8.4 or a later vendor-supported fixed release.; Review Blue Coat security advisory SA96 for vendor-specific remediation guidance.; Restrict WebUI access to trusted management networks and administrator workstations..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.