CVE-2026-3873

High

Published: 13 March 2026

Published

13 March 2026

Modified

16 March 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0001 1.9th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3873 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Avantra (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Default Accounts (T1078.001) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification

addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

AT-3 Role-based Training

addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

IA-1 Policy and Procedures

addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

IA-13 Identity Providers and Authorization Servers

addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

IA-5 Authenticator Management

addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

PL-9 Central Management

addresses: CWE-798

Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.

PM-16 Threat Awareness Program

addresses: CWE-798

Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.

PM-3 Information Security and Privacy Resources

addresses: CWE-798

Planned investment enables secure credential storage and management systems instead of hard-coded credentials.

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Hard-coded legacy built-in account enables use of default credentials for unauthorized access (T1078.001); network-reachable service with no auth required maps to exploitation of public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0.

Deeper analysisAI

CVE-2026-3873 is a Use of Hard-coded Credentials vulnerability (CWE-798) in Avantra that allows accessing functionality not properly constrained by ACLs. This issue affects Avantra versions before 25.3.0 and has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility and lack of prerequisites.

Remote attackers require only network access to exploit this vulnerability, with no privileges, user interaction, or special conditions needed. Exploitation grants unauthorized access to restricted functionality via the hard-coded credentials, enabling limited impacts to confidentiality and integrity under a changed scope.

Avantra's security advisory at https://support.avantra.com/hc/en-us/articles/5352465121695-Security-Notice-Legacy-Built-In-User-Account-rtm addresses this vulnerability, which is fixed in version 25.3.0. Practitioners should update affected systems to mitigate the risk.