Platform CVE-2026-5376

The CVSS score of 5.9 (Medium) is driven by network-accessible attack vector (AV:N), high attack complexity (AC:H), and high privilege requirement (PR:H), combined with high confidentiality and integrity impacts (C:H/I:H). The PR:H constraint significantly limits real-world risk, as this vulnerability requires a currently authenticated high-privilege administrator account. The attack complexity is high, suggesting the automatic page reload condition must occur in a specific state. While no EPSS data or CISA KEV status is provided, the combination of authentication barrier, high complexity, and no public exploit code indicates this is a lower-priority remediation compared to unauthenticated or low-complexity vulnerabilities of similar CVSS score. The primary risk is insider threat or session hijacking scenarios where an attacker gains control of an admin session and exploits the timeout bypass; this is a real but constrained threat model.

An authenticated administrator account is compromised or left unattended. An attacker leverages the automatic page reload feature to continuously refresh the application without triggering session inactivity timeout, maintaining access to administrative functions (user management, asset data modification, configuration changes) beyond the organization's intended session limit. The attacker could modify asset inventories, alter security settings, or extract sensitive network intelligence before the legitimate administrator detects the breach through other means.