Critical severity · published Mar 4, 2026
CVE-2025-59786
Cookies are not Invalidated upon Logout and Password Change
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N Telekomunikace a.s.
before 3.5 · source: vendor
AC
Access Commander · 2n
before 3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59786
Vendor Advisory
https://www.2n.com/en-GB/download/cve_2025_59786_acom_3_5_v1pdf
More from 2N Access Commander
7.2
CVE-2025-59785
API - Insufficient Input Validation
7.2
CVE-2025-59784
Log Pollution - Control Characters Not Escaped
7.2
CVE-2025-59783
OS Command Injection over API
6.5
CVE-2025-59787
HTTP 5XX Internal Server Errors