CVE-2016-9165: The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 a...

Security readout for executives and security teams

CVE-2016-9165 affects CA Unified Infrastructure Management and UIM Snap before 8.5. A vulnerable servlet could let a remote attacker obtain active session IDs, potentially bypassing authentication or gaining privileges. This is business-relevant because monitoring platforms often have broad operational visibility and administrative reach. Exposure is most likely where CA Unified Infrastructure Management or UIM Snap versions before 8.5 are deployed, especially if web management components are reachable from untrusted networks. Treat as high priority if any affected monitoring platform is still deployed. The risk is not just data exposure; session compromise could undermine trust in operational monitoring and administrative workflows. Mitigation focus: Inventory CA UIM and UIM Snap deployments and identify versions before 8.5.; Prioritize upgrade or vendor-approved remediation for affected pre-8.5 systems.; Restrict access to UIM web management interfaces to trusted administration networks..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.