CVE-2026-8670CWE-613

Insecure session handling on metrics web server

Critical · published May 22, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay).

This issue affects Avantra: before 25.3.1.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-05-22T13:12Z
EPSS history
Timeline
  • 22 MAY 13:12Z
    Insecure session handling on metrics web server
    cvelistv5