Medium severity · published Mar 4, 2026
CVE-2025-59787
HTTP 5XX Internal Server Errors
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipulated requests, indicating improper handling of invalid input and potential security or availability impacts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N Telekomunikace a.s.
before 3.5 · source: vendor
AC
Access Commander · 2n
before 3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59787
Vendor Advisory
https://www.2n.com/en-GB/download/cve_2025_59787_acom_3_5_v1pdf
More from 2N Access Commander
9.8
CVE-2025-59786
Cookies are not Invalidated upon Logout and Password Change
7.2
CVE-2025-59785
API - Insufficient Input Validation
7.2
CVE-2025-59784
Log Pollution - Control Characters Not Escaped
7.2
CVE-2025-59783
OS Command Injection over API