TI-2024-27247 Aliases CVE-2024-40872 GHSA-3gx2-67xw-9fc9

Elevation of privilege in Absolute Secure Access clients and servers

LOW 37CWE-822Published 2024-07-25 · Updated 2024-08-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-822 and the CVSS impact.

Summary

There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, the impact to system confidentiality and integrity is high, the impact to the availability of the effected component is none.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00156 4th percentileScored 2026-11-07

Fix Fixed Secure Access (Absolute Security): 13.07

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Absolute Security	Secure Access	before 13.07	13.07	Patch available	CNA

Secure Access VendorAbsolute Security Affected before 13.07 Fixed in 13.07 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:absolute:secure_access::::::::	—	—	Absolute Security

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:* Versions — — ·Absolute Security

Remediation

Fix · CNA Secure Access (Absolute Security) Fixed in 13.07

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-07-25
Absolute Security Secure Access 13.07
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-27248 XSS in Secure Access administrative consolePriority LOW 20
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-40872
2026-10-03 Alias added: GHSA-3gx2-67xw-9fc9

References

Other 1

https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40872/

TI-2026-84100 Authentication bypass in Absolute Security Secure Access Servers CVSS 4.0CRITICAL 9.3
TI-2026-69281 Denial of service in Absolute Secure Access connection setup CVSS 4.0HIGH 8.7
TI-2026-25841 Memory management vulnerability in Secure Access servers CVSS 4.0HIGH 8.7
TI-2026-84098 Cross-site request forgery in Absolute Security Secure Access server CVSS 4.0CRITICAL 9.4
TI-2018-11965 An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. CVSS 3.0HIGH 8.8
TI-2026-39972 Out-of-bounds read in Absolute Security Secure Access CVSS 4.0HIGH 8.7

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences