CVE-2026-8670
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Insufficient session expiration in syslink software AG Avantra on Linux and Windows allows reusing session IDs (Session Replay). This issue affects Avantra before version 25.3.1.
Risk Assessment
An attacker can intercept and reuse another user's session, gaining unauthorized access to the system and data.
Recommendation
Update Avantra to version 25.3.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Avantra
See all- CVE-2026-3873High
The Use of Hard-coded Credentials vulnerability in Avantra allows accessing functionality not properly constrained by ACLs. This issue affects Avantra versions before 25.3.0.
- CVE-2026-8673Medium
Unprotected transport of credentials in syslink AG Avantra on Linux and Windows allows sniffing attacks. Affects versions before 25.3.0.
- CVE-2026-8672Medium
syslink AG Avantra before version 25.3.0 on Linux and Windows uses default passwords. This allows an attacker to try common or default usernames and passwords.
- CVE-2026-8671High
Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure.
Original NVD description (English source)
Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS