What is the CVSS score of CVE-2026-5376?

CVE-2026-5376 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5376?

Yes, a patch is available for CVE-2026-5376. Update the affected software to the latest version immediately.

Platform CVE-2026-5376

EUVD-2026-19692 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-04-07 runZero

Information Disclosure Platform Runzero

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260203.0

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19692

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:11 nvd

MEDIUM 5.9

DescriptionCVE.org

An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is an instance of CWE-613: Insufficient Control of Resources After Expiration or Release, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (5.9 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

AnalysisAI

Session inactivity timeouts fail to trigger in runZero Platform due to automatic page reloading, allowing authenticated administrators to maintain unauthorized access beyond intended session expiration windows. This CWE-613 resource control vulnerability affects runZero Platform versions prior to 4.0.260203.0 and requires high-privilege authentication, with confirmed confidentiality and integrity impacts. No public exploit code or active exploitation has been reported.

Technical ContextAI

The vulnerability resides in runZero Platform's session management mechanism, specifically in the interaction between the session timeout controller and the automatic page reload function. CWE-613 (Insufficient Control of Resources After Expiration or Release) indicates the underlying defect: the session expiration timer is not properly enforced when automatic page reloading occurs, allowing session resources to persist beyond their intended lifetime. The affected product is the runZero Platform (CPE: cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*), which is a network asset discovery and management solution. The flaw permits an authenticated high-privilege user to inadvertently or deliberately bypass inactivity-based session termination by allowing the application to continuously reload, effectively resetting the inactivity clock without re-authentication.

RemediationAI

Upgrade runZero Platform to version 4.0.260203.0 or later, which includes the fix for session timeout enforcement. Administrators should review release notes at https://help.runzero.com/docs/release-notes/#402602030 and apply the patch without delay. As an interim measure, disable automatic page reloading if the feature is configurable, or implement additional session monitoring and enforce manual re-authentication for sensitive operations. Refer to the official security advisory at https://www.runzero.com/advisories/runzero-platform-session-timeout-failure-cve-2026-5376/ for additional guidance.