TI-2026-84098 Aliases CVE-2026-97718 GHSA-g239-47xv-3894

Cross-site request forgery in Absolute Security Secure Access server

MEDIUM 42CWE-352Published 2026-11-02 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Absolute Security Secure Access version 14.60 contains a cross-site request forgery flaw (CWE-352). A security control that should block forged requests is bypassed. A remote attacker can cause an administrator to create an account under the attacker's control.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Absolute Security	Secure Access	14.60	—	No fix listed	CNA

Secure Access VendorAbsolute Security Affected 14.60 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:absolute:secure_access::::::::	—	—	Absolute Security

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:* Versions — — ·Absolute Security

Remediation

The sources list no fixed version for Secure Access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

2026-11-02 Threatist record created from CVE-2026-97718
2026-11-02 Alias added: GHSA-g239-47xv-3894
2026-11-06 Weakness changed · CISA ADP
2026-11-06 CISA SSVC decision points changed

References

Other 1

https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

TI-2026-84100 Authentication bypass in Absolute Security Secure Access Servers CVSS 4.0CRITICAL 9.3
TI-2026-69281 Denial of service in Absolute Secure Access connection setup CVSS 4.0HIGH 8.7
TI-2026-25841 Memory management vulnerability in Secure Access servers CVSS 4.0HIGH 8.7
TI-2018-11965 An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. CVSS 3.0HIGH 8.8
TI-2026-39972 Out-of-bounds read in Absolute Security Secure Access CVSS 4.0HIGH 8.7
TI-2026-29603 Privilge misconfiguration in Secure Access installers CVSS 4.0HIGH 8.5

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences