What is the CVSS score of CVE-2025-10228?

CVE-2025-10228 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Rolantis Agentis are affected by CVE-2025-10228?

Rolantis Agentis prior to version 4.44 contains a critical session hijacking vulnerability that allows attackers to inherit authenticated user sessions if victims are tricked into using…

How to fix or mitigate CVE-2025-10228?

Within 24 hours: Identify and document all Rolantis Agentis installations and user populations; assess whether Agentis is used for critical authentication/authorization. Within 7 days: Enable comprehensive session activity logging and anomaly detection; contact Rolantis for patch release timeline and subscribe to vendor security advisories. Within 30 days: Upgrade to Agentis version 4.44 or later immediately upon vendor release.

Rolantis Agentis CVE-2025-10228

HIGH

Session Fixation (CWE-384)

2025-10-14 iletisim@usom.gov.tr

Information Disclosure Session Fixation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 11:30 vuln.today

DescriptionCVE.org

Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.

This issue affects Agentis: before 4.44.

AnalysisAI

Session hijacking against Rolantis Information Technologies Agentis prior to version 4.44 is possible because the application fails to regenerate session identifiers across authentication state changes, letting a remote attacker who can lure a victim into using an attacker-supplied session token take over the authenticated session. CVSS 8.8 reflects full confidentiality, integrity, and availability impact once hijacked, but no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

Agentis is a Turkish enterprise/agency management platform published by Rolantis Information Technologies, and the flaw is a classic CWE-384 Session Fixation: the application accepts a pre-existing session identifier (typically delivered via URL parameter or cookie before login) and continues to honor that same identifier after the victim authenticates, instead of issuing a fresh, unpredictable session ID at the privilege boundary. Because the session token is the sole binding between the browser and the authenticated principal, an attacker who knows the fixated value inherits the victim's authorization context once login completes. The CWE-384 root cause is failure to invoke session regeneration on authentication, a well-understood web-application defect.

Affected ProductsAI

Rolantis Information Technologies Agentis at all versions prior to 4.44 is affected; version 4.44 is the fixed baseline. No CPE strings were provided in the input data to narrow product editions or deployment modes, and no vendor advisory URL is included in the references - the only linked sources are the Turkish national CERT bulletins at https://www.usom.gov.tr/bildirim/tr-25-0336 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0336, which should be consulted for the authoritative product/edition list.

RemediationAI

Vendor-released patch: Agentis 4.44 - upgrade all instances to 4.44 or later as the primary fix, per the Turkish CERT advisories at https://www.usom.gov.tr/bildirim/tr-25-0336 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0336. If immediate upgrade is not possible, compensating controls include forcing a fresh session cookie issuance at the reverse proxy or WAF on every successful login response (rewrite or strip pre-existing session cookies on the login endpoint), refusing session identifiers passed via URL query string (block requests containing the session parameter in the query, accepting only cookie-borne tokens), and shortening session cookie lifetime with the HttpOnly, Secure, and SameSite=Strict attributes to shrink the fixation window - note that strict SameSite can break legitimate cross-site SSO flows and proxy-level cookie rewriting can desynchronize sticky-session load balancers, so test before broad rollout. User-awareness controls (warn users not to follow login links from untrusted sources) reduce but do not eliminate the UI:R precondition.