How severe is CVE-2016-8581?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2016-8581 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Alienvault Open Source Security Information And Event Management

CVE-2016-8581

A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2016-10-28 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.171 (97.0th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.171 · newest: 0.171 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

www.securityfocus.com/bid/93862 (vdb-entry)
www.exploit-db.com/exploits/40683/ (exploit)
www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-ad… (Vendor Advisory)

Frequently asked questions

What is CVE-2016-8581?: CVE-2016-8581 is a medium-severity vulnerability in Alienvault Open Source Security Information And Event Management, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2016-10-28.
How severe is CVE-2016-8581?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2016-8581 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.