Avantra CVE-2026-8670

Exploitation requires the attacker to first obtain a valid Avantra session ID belonging to a legitimate user - via network interception, XSS, a malicious link, or access to client-side storage - which aligns with the UI:R element of the CVSS vector (a user must interact in a way that exposes their session). Once a token is obtained, no authentication is needed to replay it (PR:N) and the Avantra web endpoint must be network-reachable from the attacker (AV:N). Limiting factors: the deployment must be running a vulnerable Avantra version (before 25.3.1) on Linux or Windows, and the attacker must reach the session-token-issuing endpoint, so instances behind a VPN or restricted to a management network materially reduce realistic exposure.

Signals are mixed but lean toward elevated risk for exposed deployments. The CVSS 9.6 vector indicates network reachability (AV:N), low complexity (AC:L), no privileges required (PR:N), and scope change (S:C) with full CIA impact - meaning successful replay yields complete compromise of resources beyond the vulnerable component (a credible outcome given Avantra's reach into SAP/managed systems). However, UI:R means the attacker must first induce or capture a user action to obtain the replayable session ID, which tempers the practical attack surface. There is no EPSS score, KEV listing, or POC referenced in the supplied data, so this is not yet confirmed actively exploited; the CWE class is well-understood and trivially exploitable once a token is captured, so prioritize patching for any internet-exposed or shared-network Avantra instance.

An attacker on the same network segment (or able to intercept traffic, e.g., via a malicious proxy or compromised browser extension) captures an Avantra session cookie issued to a legitimate operator; because sessions are not properly invalidated, the attacker replays the cookie from their own host after the user logs out or hours later and gains the user's privileges within Avantra. From there, the attacker leverages Avantra's monitoring and orchestration access to read sensitive configuration of managed SAP systems and potentially trigger administrative actions - consistent with the CVSS scope-change rating. No public exploit identified at time of analysis, but the technique is generic to CWE-613.