CVE-2025-10223: Axxonsoft Axxon One

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.

Affected products

• Axxonsoft Axxon One: up to and including 2.0.2

Published 2025-09-10. Last modified 2026-09-26.