Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family AC

AC-12Session Termination

Automatically terminate a user session after {{ insert: param, ac-12_odp }}.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (6)

Weaknesses this control addresses (2)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-613Insufficient Session Expiration606Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.
CWE-384Session Fixation469Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2026-263422.09.80.0041good
CVE-2024-139962.09.80.0020good
CVE-2024-132802.09.80.0017good
CVE-2026-216222.09.80.0006good
CVE-2025-597862.09.80.0006good
CVE-2026-14352.09.80.0007good
CVE-2025-538262.09.80.0034good
CVE-2025-249731.99.30.0008good
CVE-2025-566431.89.10.0013good
CVE-2025-577351.89.10.0004good
CVE-2025-604251.88.60.0151good
CVE-2024-453861.88.80.0025good
CVE-2026-345721.88.80.0010good
CVE-2026-345701.88.80.0003good
CVE-2025-658831.78.40.0008good
CVE-2024-450331.78.10.0100good
CVE-2025-248961.68.10.0027good
CVE-2025-299281.68.00.0020good
CVE-2026-345031.68.10.0001good
CVE-2026-282751.68.10.0002good
CVE-2024-574331.57.50.0019good
CVE-2024-348961.57.50.0031good
CVE-2024-335071.57.40.0012good
CVE-2025-223861.57.30.0019good
CVE-2024-116271.46.80.0012good

Other controls in family AC

AC-1 AC-10 AC-11 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-2 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9