CVE-2025-59786
Published: 04 March 2026
Summary
CVE-2025-59786 is a medium-severity Insufficient Session Expiration (CWE-613) vulnerability in 2N Access Commander. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 16.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-12 (Session Termination) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-59786 is a critical vulnerability in 2N Access Commander versions 3.4.2 and prior, where the web application improperly invalidates session tokens upon logout. This flaw allows multiple session cookies to remain active, enabling persistent unauthorized access even after a user logs out. The issue is classified under CWE-613 (Insufficient Session Expiration) and carries a CVSS v3.1 base score of 9.8, reflecting its high severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability over the network by obtaining a valid session cookie, such as through network sniffing or prior compromise, and reusing it post-logout to maintain access. Successful exploitation grants high-impact privileges, compromising confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing full control over the affected web application and associated access control functions.
The vendor has published an advisory with mitigation details, including a patch for 2N Access Commander version 3.5, available at https://www.2n.com/en-GB/download/cve_2025_59786_acom_3_5_v1pdf. Security practitioners should prioritize upgrading to the patched version and review session management configurations to prevent similar issues.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208279
Vulnerability details
2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables reuse of valid web session cookies post-logout (via prior theft/sniffing), directly facilitating Use Alternate Authentication Material with Web Session Cookies for persistent unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires automatic termination of user sessions upon logout or defined events, preventing unauthorized access via uninvalidated session tokens and cookies.
Mandates timely identification, reporting, and correction of flaws like improper session token invalidation through vendor patching to version 3.5.
Limits concurrent sessions per user or account, mitigating risks from multiple active session cookies persisting after logout.