CVE-2025-59786 is a session handling flaw in 2N Access Commander version 3.4.2 and earlier, scored CVSS 9.8 (critical). Session cookies stay valid after logout. Check 2N's advisory for the fixed version, which its address suggests is Access Commander 3.5, and update.
What's affected
The NVD record lists 2N Access Commander 3.4.2 and prior as affected. It says the application improperly invalidates session tokens, so several session cookies can remain active after a user logs out of the web application.
The 2N advisory is a PDF whose address refers to Access Commander 3.5. I could not load it (the site returned an access error), so I cannot confirm the exact fixed version. Read the advisory before you record the fix.
How to check if you're exposed
Open Access Commander and read its version from the about or system page. If it is 3.4.2 or lower, it is in the affected range.
You can test the behavior on your own instance, with your own account: sign in, copy nothing sensitive, sign out, and confirm the session no longer works from another browser. Do this only on systems you own.
What to do now
- Check the 2N advisory for the fixed version and update to it.
- Until then, avoid shared browsers and computers for Access Commander.
- Restrict the Access Commander web interface to the management network.
- Shorten session timeouts if the product allows it.
- Review the access control events for logins from unexpected addresses.
Why it matters
The class is CWE-613, insufficient session expiration. Logout is supposed to end the session on the server, not only clear a cookie in the browser. If the server keeps accepting the old cookie, a copied cookie stays useful.
The record scores this critical. For an access control management system that governs doors and credentials, a stolen session is not just a data problem, it touches physical security. Patch, and limit where the console can be reached. The KEV flag is false.
Quick check
What does it mean that logout does not end the session?
The server keeps trusting the old session cookie after the user signs out, so anyone who has a copy can keep using it.
Sources
Last reviewed: 19 October 2026.
