Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family AC

AC-12Session Termination

Automatically terminate a user session after {{ insert: param, ac-12_odp }}.

Last updated: 20 August 2026 20:22 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (6)

Weaknesses this control addresses (2)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-613Insufficient Session Expiration600+Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.
CWE-384Session Fixation400+Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2024-42447 7.59.80.0093good
CVE-2024-139967.59.80.0099good
CVE-2024-25718 7.49.80.0066good
CVE-2024-29401 7.49.80.0078good
CVE-2024-8888 7.410.00.0042good
CVE-2026-263427.49.80.0072good
CVE-2024-43685 7.39.80.0044good
CVE-2024-13280 7.39.80.0041good
CVE-2025-53826 7.39.80.0050good
CVE-2025-59841 7.39.80.0039good
CVE-2025-545927.39.80.0050good
CVE-2026-21622 7.39.80.0039good
CVE-2026-464557.39.80.0043good
CVE-2026-285647.39.80.0044good
CVE-2026-149507.39.80.0055good
CVE-2026-14357.29.80.0037good
CVE-2025-597867.29.80.0025good
CVE-2024-35049 7.09.10.0073good
CVE-2024-29070 7.09.10.0079good
CVE-2024-48827 7.08.80.0279good
CVE-2024-27455 6.99.10.0065good
CVE-2025-57735 6.99.10.0067good
CVE-2021-35473 6.89.10.0041good
CVE-2025-24859 6.88.80.0108good
CVE-2025-56643 6.89.10.0036good

Other controls in family AC

AC-1 AC-10 AC-11 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-2 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9