You patched the November 2025 XSS flaw, but if an attacker successfully injected a script into your AAA login page before the patch, they are still harvesting session tokens today. Patching code does not clean the database.

CVE: 2025-12101, Vector: AAA Virtual Server, Impact: MFA Bypass.

Improper neutralization of input during web page generation allows malicious scripts to run in the context of the user’s session.

Use CLI to verify login schemas: show vpn lclookup and scan /var/log/httpd/access.log for anomalous <script> tags in POST requests.

MFA bypass is the first step in a ransomware chain. [Forensically audit your perimeter security today]