PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3873 syslink software AG CVE debrief

CVE-2026-3873 documents a Use of Hard-coded Credentials vulnerability (CWE-798) in Avantra, affecting versions prior to 25.3.0. The vulnerability enables unauthorized access to functionality not properly constrained by access control lists (ACLs). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a network-attackable, low-complexity issue requiring no privileges or user interaction, with scope change and impacts to confidentiality and integrity. The NVD status is currently 'Deferred,' suggesting the entry may be under review or awaiting additional analysis. Avantra has published a security notice regarding a legacy built-in user account ('rtm'), which appears related to this vulnerability. Organizations running Avantra versions before 25.3.0 should prioritize upgrading to the patched release.

Vendor
syslink software AG
Product
Avantra
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-13
Original CVE updated
2026-05-19
Advisory published
2026-03-13
Advisory updated
2026-05-19

Who should care

Organizations operating Avantra IT operations monitoring and automation platforms, particularly those with externally accessible management interfaces or multi-tenant deployments where ACL bypass could expose sensitive operational data or enable lateral movement.

Technical summary

The vulnerability stems from a hard-coded credential (CWE-798) present in Avantra versions prior to 25.3.0, specifically associated with a legacy built-in 'rtm' user account. The CVSS 3.1 scoring (7.2 HIGH) reflects network accessibility, low attack complexity, no required privileges or user interaction, and a scope change indicating impact beyond the vulnerable component. Successful exploitation could allow attackers to bypass ACL constraints and access restricted functionality. The NVD entry status is 'Deferred,' indicating potential ongoing analysis. Remediation requires upgrading to Avantra 25.3.0 or later and reviewing legacy account configurations.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Avantra to version 25.3.0 or later to remediate the hard-coded credentials vulnerability.
  • Review and disable or remove any legacy built-in accounts, particularly the 'rtm' account referenced in vendor guidance, if not already addressed by the upgrade.
  • Audit access logs for unauthorized use of built-in or service accounts, especially from unexpected network sources.
  • Verify that ACLs and role-based access controls are properly enforced for all administrative and monitoring functionality after patching.
  • Monitor vendor security advisories for additional hardening recommendations or follow-on fixes.

Evidence notes

CVE published 2026-03-13; NVD modified 2026-05-19. NVD status: Deferred. CVSS 3.1 vector confirms network-attackable, unauthenticated access with scope change. Vendor security notice identifies legacy 'rtm' built-in account as the affected component.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3873 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3873

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3873 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3873

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://support.avantra.com/hc/en-us/articles/5352465121695-Security-Notice-Legacy-Built-In-User-Account-rtm

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.