CVE-2026-8673
Published: 22 May 2026
Summary
CVE-2026-8673 is a medium-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Avantra Avantra. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31436
Vulnerability details
Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-523 unprotected credential transport directly enables passive network sniffing (T1040) to capture credentials in transit.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Using a distinct channel for credential transmission prevents unprotected transport over the application's normal communication path.
Requiring protected transport for credentials directly mitigates unprotected credential transmission over networks.
Prevents unprotected transport of credentials by mandating confidentiality mechanisms such as TLS for all sensitive data flows.