Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family AC

AC-10Concurrent Session Control

Limit the number of concurrent sessions for each {{ insert: param, ac-10_odp.01 }} to {{ insert: param, ac-10_odp.02 }}.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (4)

Weaknesses this control addresses (2)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-400Uncontrolled Resource Consumption3,324Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.
CWE-770Allocation of Resources Without Limits or Throttling1,979This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2023-19071.68.00.0010good
CVE-2026-326631.57.30.0002good
CVE-2026-276491.57.30.0005good
CVE-2025-552750.73.70.0001good
CVE-2024-421760.52.60.0016good
CVE-2026-14352.09.80.0007good
CVE-2025-301181.57.50.0037good
CVE-2026-401161.57.50.0010good
CVE-2025-635291.26.10.0008partial
CVE-2024-139962.09.80.0020partial
CVE-2025-597862.09.80.0006partial
CVE-2026-243522.09.80.0002partial
CVE-2025-526892.09.80.0078partial
CVE-2025-18011.68.10.0011partial
CVE-2025-710561.68.10.0004partial
CVE-2024-466671.57.50.0064partial
CVE-2024-417431.57.50.0007good
CVE-2026-413991.57.50.0007good
CVE-2026-348241.57.50.0003partial
CVE-2026-332541.15.30.0001good

Other controls in family AC

AC-1 AC-11 AC-12 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-2 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9