CVE-2026-8670

CriticalCVSS 9.6

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Insufficient session expiration in syslink software AG Avantra on Linux and Windows allows reusing session IDs (Session Replay). This issue affects Avantra before version 25.3.1.

Risk Assessment

An attacker can intercept and reuse another user's session, gaining unauthorized access to the system and data.

Recommendation

Update Avantra to version 25.3.1 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1.