NIST 800-53 r5 · Controls catalogue · Family AC
AC-12Session Termination
Automatically terminate a user session after {{ insert: param, ac-12_odp }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 5 mapping(s) from 2 framework(s): ASVS 5.0 4 (partial) · CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (6)
Weaknesses this control addresses (2)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-613 | Insufficient Session Expiration | 642 | Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit. |
CWE-384 | Session Fixation | 489 | Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-26342 | 7.0 | 9.8 | 0.0072 | good |
CVE-2024-13996 | 7.0 | 9.8 | 0.0096 | good |
CVE-2024-13280 | 7.0 | 9.8 | 0.0039 | good |
CVE-2025-24973 | 7.0 | 9.3 | 0.0018 | good |
CVE-2025-56643 | 7.0 | 9.1 | 0.0032 | good |
CVE-2025-57735 | 7.0 | 9.1 | 0.0067 | good |
CVE-2026-21622 | 7.0 | 9.8 | 0.0039 | good |
CVE-2025-59786 | 7.0 | 9.8 | 0.0025 | good |
CVE-2026-1435 | 7.0 | 9.8 | 0.0037 | good |
CVE-2025-53826 UPD | 7.0 | 9.8 | 0.0050 | good |
CVE-2022-2466 | 7.0 | 9.8 | 0.0150 | good |
CVE-2025-60425 | 5.5 | 8.6 | 0.0094 | good |
CVE-2024-45386 | 5.5 | 8.8 | 0.0051 | good |
CVE-2026-34572 | 5.5 | 8.8 | 0.0050 | good |
CVE-2026-34570 | 5.5 | 8.8 | 0.0050 | good |
CVE-2025-65883 | 5.5 | 8.4 | 0.0035 | good |
CVE-2024-45033 | 5.5 | 8.1 | 0.0092 | good |
CVE-2025-24896 | 5.5 | 8.1 | 0.0055 | good |
CVE-2025-29928 | 5.5 | 8.0 | 0.0036 | good |
CVE-2026-34503 | 5.5 | 8.1 | 0.0033 | good |
CVE-2024-57433 | 5.5 | 7.5 | 0.0042 | good |
CVE-2024-34896 | 5.5 | 7.5 | 0.0036 | good |
CVE-2024-33507 | 5.5 | 7.4 | 0.0037 | good |
CVE-2025-22386 | 5.5 | 7.3 | 0.0027 | good |
CVE-2026-34828 | 5.5 | 7.1 | 0.0030 | good |