CVE-2026-3873

HighUpdated

Published: 13 March 2026

Published

13 March 2026

Modified

19 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0001 2.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3873 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Avantra (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).

Deeper analysis

CVE-2026-3873 is a Use of Hard-coded Credentials vulnerability (CWE-798) in Avantra that allows accessing functionality not properly constrained by ACLs. This issue affects Avantra versions before 25.3.0 and has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility and lack of prerequisites.

Remote attackers require only network access to exploit this vulnerability, with no privileges, user interaction, or special conditions needed. Exploitation grants unauthorized access to restricted functionality via the hard-coded credentials, enabling limited impacts to confidentiality and integrity under a changed scope.

Avantra's security advisory at https://support.avantra.com/hc/en-us/articles/5352465121695-Security-Notice-Legacy-Built-In-User-Account-rtm addresses this vulnerability, which is fixed in version 25.3.0. Practitioners should update affected systems to mitigate the risk.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-11768

Vulnerability details

Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0.

CWE(s): CWE-798

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Hard-coded legacy built-in account enables use of default credentials for unauthorized access (T1078.001); network-reachable service with no auth required maps to exploitation of public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1