CVE-2026-16970

MEDIUM

DFIR-IRIS Insufficient Logout Implementation

Title source: cna
STIX 2.1

Description

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

References (2)

Core 2

Scores

CVSS v3 4.2
EPSS 0.0016
EPSS Percentile 6.2%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-613
Status published
Products (1)
dfir-iris/iris-web 2.4.26
Published Jul 30, 2026
Tracked Since Jul 30, 2026