What is the CVSS score of CVE-2026-3873?

CVE-2026-3873 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avantra are affected by CVE-2026-3873?

Avantra versions prior to 25.3.0 contain a hard-coded credential vulnerability that enables unauthorized access to functionality normally restricted by access controls, creating a direct risk for…. A patch is available.

How to fix or mitigate CVE-2026-3873?

Within 24 hours: Inventory all Avantra instances and document current versions. Within 7 days: Upgrade all Avantra installations to version 25.3.0 or later per vendor patch release. Within 30 days: Conduct access log review for Avantra to identify potential unauthorized credential usage, and implement network segmentation to restrict Avantra administrative access to trusted networks only.

Avantra CVE-2026-3873

EUVD-2026-11768 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-03-13 NCSC.ch

Authentication Bypass Avantra Syslink Software Ag

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:23 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25.3.0

EUVD ID Assigned

Mar 13, 2026 - 08:34 euvd

EUVD-2026-11768

Analysis Generated

Mar 13, 2026 - 08:34 vuln.today

CVE Published

Mar 13, 2026 - 08:14 nvd

HIGH 7.2

DescriptionCVE.org

Use of Hard-coded Credentials vulnerability in Avnatra Avantra allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avantra: before 25.3.0.

AnalysisAI

High severity vulnerability in Avantra. Use of Hard-coded Credentials vulnerability in Avnatra Avantra allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avantra: before 25.3.0.

Technical ContextAI

Vulnerability Type: Use of Hard-coded Credentials (CWE-798) CVSS 3.1: 7.2/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Authentication Bypass Source: NCSC.ch Cross-site scripting allows injection of malicious scripts that execute in victims' browsers, potentially stealing sessions or credentials. Authentication bypass allows attackers to access protected resources without valid credentials.