CVE-2026-8670: Insecure session handling on metrics web server

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-22 · updated 2026-07-23
Weakness: CWE-613

Description

Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1.

Affected products

syslink software AG Avantra: before 25.3.1 — fixed in 25.3.1

How to fix

Upgrade to a fixed version: syslink software AG Avantra 25.3.1. Check the vendor advisory for mitigations.

References

https://support.avantra.com/hc/en-us/articles/5533929912351

Get alerted when CVE-2026-8670 or the next vulnerability affects your stack