High severity · published Mar 4, 2026
CVE-2025-59784
Log Pollution - Control Characters Not Escaped
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validation or sanitisation.
This vulnerability can only be exploited after authenticating with administrator privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N Telekomunikace a.s.
before 3.4.2 · source: vendor
AC
Access Commander · 2n
before 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59784
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59784
Vendor Advisory
https://www.2n.com/en-GB/download/cve_2025_59784_acom_3_5_v1pdf
More from 2N Access Commander
9.8
CVE-2025-59786
Cookies are not Invalidated upon Logout and Password Change
7.2
CVE-2025-59785
API - Insufficient Input Validation
7.2
CVE-2025-59783
OS Command Injection over API
6.5
CVE-2025-59787
HTTP 5XX Internal Server Errors