CVE-2026-5376

CVE-2026-5376 affects the runZero Platform (versions prior to 4.0.260203.0) and involves a session management flaw where automatic page reloading can prevent session inactivity timeouts from triggering. This is classified as CWE-613, an insufficient control of resources after expiration or release vulnerability. The flaw could allow an attacker to maintain access to an authenticated session beyond its intended timeout period. The vulnerability carries a CVSS score of 5.9 (Medium) with a network-based attack vector requiring high privilege level and high attack complexity. The impact assessment indicates potential for both confidentiality and integrity compromise, though availability is not affected. The relatively low CVSS score reflects the high barriers to exploitation, including the need for high privileges and sophisticated attack conditions. Current exploitation status indicates minimal real-world threat, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and does not appear on active threat lists. The EPSS score of 0.00044 suggests this vulnerability has an extremely low probability of exploitation in the wild. The vulnerability has been patched in version 4.0.260203.0 and should be prioritized for update based on internal risk assessments rather than immediate external threat indicators.