What is the CVSS score of CVE-2026-8673?

CVE-2026-8673 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avantra are affected by CVE-2026-8673?

Avantra versions prior to 25.3.0 fail to encrypt credentials for monitored systems, allowing network attackers to capture valid authentication material for your SAP infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-8673?

Within 24 hours, identify all Avantra deployments and their current versions; implement network segmentation to restrict Avantra communication to trusted internal networks only, and monitor SAP systems for anomalous credential usage. Within 7 days, upgrade all instances to Avantra version 25.3.0 or later. Within 30 days, reset all credentials for SAP users monitored by Avantra to clear potentially intercepted material, review access logs for unauthorized activity during the vulnerability window, and validate encryption status post-upgrade.

Avantra CVE-2026-8673

EUVD-2026-31436 CRITICAL

Unprotected Transport of Credentials (CWE-523)

2026-05-22 NCSC.ch

GHSA-v88w-jgrg-7946

Microsoft Information Disclosure Avantra

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

Sniffing/MITM requires a privileged network position, so AC:H; credential disclosure gives C:H, but integrity impact is only indirect via replay, so I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM CRITICAL

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.9 (MEDIUM) 9.1 (CRITICAL)

Patch available

May 26, 2026 - 14:16 EUVD

Analysis Generated

May 22, 2026 - 14:04 vuln.today

DescriptionNVD

Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks.

This issue affects Avantra: before 25.3.0.

AnalysisAI

Cleartext credential exposure in syslink software AG's Avantra (an SAP/enterprise infrastructure monitoring and automation platform) on Linux and Windows allows a network-positioned attacker to capture authentication credentials by sniffing traffic, because sensitive credentials are transported without adequate encryption in all releases before 25.3.0. Successful interception yields valid credentials that can be replayed against the monitored SAP landscape and Avantra itself. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but SSVC rates the technical impact as total.

Technical ContextAI

Avantra is an AIOps/monitoring and automation platform widely used to manage SAP and adjacent enterprise system landscapes, where its agents and server continuously exchange privileged credentials to log into and operate managed systems. The flaw maps to CWE-523 (Unprotected Transport of Credentials), meaning credential material is sent over a channel that lacks confidentiality protection (missing, weak, or improperly enforced TLS), so anyone able to observe the traffic can read it. The single CPE affected - cpe:2.3:a:syslink_software_ag:avantra:*:*:*:*:*:*:*:* - covers all Avantra versions prior to 25.3.0 on both Linux and Windows deployments. Because Avantra brokers highly privileged access to backend SAP systems, credentials traversing this channel are typically high-value service or administrative accounts.

RemediationAI

Upgrade to Avantra 25.3.0 or later, which the vendor lists as the first fixed release (Vendor-released patch: 25.3.0); follow the vendor advisory at https://support.avantra.com/hc/en-us/articles/5535621927071 and the EUVD/NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8673. Until patched, reduce exposure of the credential-bearing traffic: enforce TLS on all Avantra server-to-agent and management channels if a configuration option exists, isolate Avantra and its managed-system communication onto a dedicated, tightly access-controlled management VLAN or IPsec-protected segment to deny attackers a sniffing position (trade-off: network re-architecture and possible connectivity changes for monitored hosts), and disable or restrict any plaintext/legacy protocol fallbacks. Because captured credentials may already be compromised where sniffing was feasible, rotate the SAP service and administrative accounts that Avantra uses after upgrading (trade-off: brief disruption to automated monitoring jobs during rotation).