What is the CVSS score of CVE-2026-3873?

CVE-2026-3873 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avantra are affected by CVE-2026-3873?

Avantra versions prior to 25.3.0 contain a hard-coded credential vulnerability that enables unauthorized access to functionality normally restricted by access controls, creating a direct risk for…. A patch is available.

How to fix or mitigate CVE-2026-3873?

Within 24 hours: Inventory all Avantra instances and document current versions. Within 7 days: Upgrade all Avantra installations to version 25.3.0 or later per vendor patch release. Within 30 days: Conduct access log review for Avantra to identify potential unauthorized credential usage, and implement network segmentation to restrict Avantra administrative access to trusted networks only.

Avantra CVE-2026-3873

EUVD-2026-11768 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-03-13 NCSC.ch

Authentication Bypass Avantra

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:23 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25.3.0

EUVD ID Assigned

Mar 13, 2026 - 08:34 euvd

EUVD-2026-11768

Analysis Generated

Mar 13, 2026 - 08:34 vuln.today

CVE Published

Mar 13, 2026 - 08:14 nvd

HIGH 7.2

DescriptionCVE.org

Use of Hard-coded Credentials vulnerability in Avnatra Avantra allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avantra: before 25.3.0.

AnalysisAI

High severity vulnerability in Avantra. Use of Hard-coded Credentials vulnerability in Avnatra Avantra allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avantra: before 25.3.0.

Technical ContextAI

Vulnerability Type: Use of Hard-coded Credentials (CWE-798) CVSS 3.1: 7.2/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Authentication Bypass Source: NCSC.ch Cross-site scripting allows injection of malicious scripts that execute in victims' browsers, potentially stealing sessions or credentials. Authentication bypass allows attackers to access protected resources without valid credentials.