Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family AC

AC-10Concurrent Session Control

Limit the number of concurrent sessions for each {{ insert: param, ac-10_odp.01 }} to {{ insert: param, ac-10_odp.02 }}.

Last updated: 19 May 2026 14:18 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (4)

Weaknesses this control addresses (2)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-400Uncontrolled Resource Consumption3,366Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.
CWE-770Allocation of Resources Without Limits or Throttling2,022This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2023-19071.68.00.0010good
CVE-2026-32663 UPD1.57.30.0002good
CVE-2026-27649 UPD1.57.30.0005good
CVE-2025-552750.73.70.0001good
CVE-2024-421760.52.60.0016good
CVE-2026-14352.09.80.0007good
CVE-2025-301181.57.50.0037good
CVE-2026-401161.57.50.0011good
CVE-2026-276301.57.50.0014good
CVE-2026-32062 UPD1.57.50.0014good
CVE-2026-18481.57.50.0008good
CVE-2021-478651.57.50.0002good
CVE-2025-635291.26.10.0006partial
CVE-2025-526892.19.80.0157partial
CVE-2024-139962.09.80.0020partial
CVE-2025-597862.09.80.0006partial
CVE-2026-243522.09.80.0002partial
CVE-2025-18011.68.10.0011partial
CVE-2025-710561.68.10.0004partial
CVE-2024-466671.57.50.0064partial
CVE-2024-417431.57.50.0007good
CVE-2026-413991.57.50.0007good
CVE-2026-348241.57.50.0004partial
CVE-2026-251141.57.50.0010partial
CVE-2026-257911.57.50.0003good

Other controls in family AC

AC-1 AC-11 AC-12 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-2 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9