What is the CVSS score of CVE-2026-8671?

CVE-2026-8671 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Avantra are affected by CVE-2026-8671?

Avantra (syslink software AG) versions before 25.3.0 expose sensitive data through log file access on Windows and Linux systems when accessed by privileged, network-adjacent users.. A patch is available.

How to fix or mitigate CVE-2026-8671?

Within 24 hours: Identify all systems running Avantra versions < 25.3.0 and restrict network access to trusted internal subnets only. Within 7 days: Implement file-level encryption on Avantra log directories (/var/log/avantra or equivalent), enable filesystem audit logging for log access, and segment Avantra infrastructure from general network access. Within 30 days: Monitor syslink software AG security advisories for version 25.3.0+ patch release and develop staged upgrade plan.

Avantra CVE-2026-8671

EUVD-2026-31438 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-05-22 NCSC.ch

GHSA-5qp4-pv6p-8gcx

Microsoft Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 26, 2026 - 14:16 EUVD

Analysis Generated

May 22, 2026 - 14:00 vuln.today

DescriptionCVE.org

Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure.

This issue affects Avantra: before 25.3.0.

AnalysisAI

Sensitive information disclosure in syslink software AG Avantra (versions before 25.3.0) on Linux and Windows allows an attacker with high privileges and adjacent network access to harvest data written into log files, with a scope-changed impact crossing trust boundaries. The flaw is tracked as CWE-532 and rated CVSS 7.5, but no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Avantra is an AIOps/monitoring platform from syslink software AG used to observe SAP and adjacent enterprise infrastructure across Linux and Windows hosts. The weakness maps to CWE-532 (Insertion of Sensitive Information into Log File), a class of bug where the application writes credentials, tokens, session data, or other secrets to diagnostic, debug, or audit logs that are then readable by anyone with access to those logs. The vendor's own description characterizes the consequence as 'Resource Leak Exposure,' implying that secrets governing access to monitored resources (e.g., credentials, API keys, or connection strings used by Avantra agents) end up in log artifacts rather than staying confined to the secrets store.

RemediationAI

Vendor-released patch: Avantra 25.3.0 - upgrade all Avantra server and agent installations on both Linux and Windows to 25.3.0 or later as described in the vendor advisory at https://support.avantra.com/hc/en-us/articles/5535487249183. Because the vulnerability writes sensitive data into log files, patching alone is not sufficient: rotate any credentials, API tokens, or connection secrets that Avantra may have logged on vulnerable versions, and purge or archive (with restricted access) historical log files that could still contain leaked material. Until the upgrade is complete, restrict filesystem and SIEM access to Avantra log directories to the minimum set of operators, tighten the adjacent network segment containing Avantra (the CVSS AV:A vector means an attacker must already be on the same broadcast/management segment), and review who holds the high-privilege accounts (PR:H) that can read those logs.