CVE-2026-8673 is an unprotected transport of credentials flaw in syslink Avantra on Linux and Windows (CVSS 5.9, medium). Credentials could be sniffed on the network. The record says versions before 25.3.0 are affected, so upgrade to 25.3.0 or later. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says Avantra before 25.3.0 is affected, on Linux and Windows. The weakness is CWE-523, unprotected transport of credentials. The vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N.
The vendor page was blocked from my tooling, so I could not read the details of the fix. The record implies that 25.3.0 and later are not affected, so confirm with the vendor article. The record is not in the CISA KEV catalog.
How to check if you're exposed
Read the Avantra version in the web interface or the server information page. If it is below 25.3.0, you are in the affected range. Then check how agents and users reach the server, and whether connections use HTTPS or an unencrypted protocol.
What to do now
- Upgrade Avantra to 25.3.0 or later.
- Make sure all connections to the server use TLS with a valid certificate.
- Rotate credentials used by Avantra agents and integrations, if traffic crossed untrusted networks.
- Keep monitoring traffic on separate management networks where possible.
- Read the vendor article linked from the record.
Why it matters
Sending credentials in clear text means anyone positioned on the network path can read them. The scoring is moderate because such a position is hard to get and the attacker needs privileges.
It is also a reminder to check transport settings on internal tools. Management traffic is often assumed to be safe because it is internal.
Quick check
Why is the score medium?
The vector shows high attack complexity and a privileged position, which lower the base score. The impact on confidentiality is still high.
Sources
Last reviewed: 19 October 2026.
