TI-2026-84100 Aliases CVE-2026-116769 GHSA-2v8x-56rq-wmw5

Authentication bypass in Absolute Security Secure Access Servers

MEDIUM 46CWE-287Published 2026-11-02 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Absolute Security Secure Access servers from 13.0 before 14.61 contain an authentication bypass caused by improper authentication (CWE-287). A remote attacker without credentials can change the security settings of a client through the server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00408 35th percentileScored 2026-11-07

Fix Fixed Secure Access (Absolute Security): 14.61

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Absolute Security	Secure Access	13.0 to before 14.61	14.61	Patch available	CNA

Secure Access VendorAbsolute Security Affected 13.0 to before 14.61 Fixed in 14.61 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:absolute:secure_access::::::::	—	—	Absolute Security

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:* Versions — — ·Absolute Security

Remediation

Absolute Security Secure Access is fixed in version 14.61, so upgrade affected servers from 13.0 before 14.61 to 14.61 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA Secure Access (Absolute Security) Fixed in 14.61

Timeline

2026-11-02 Threatist record created from CVE-2026-116769
2026-11-02 Alias added: GHSA-2v8x-56rq-wmw5
2026-11-06 Weakness changed · CISA ADP
2026-11-06 CISA SSVC decision points changed

References

Other 1

https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116769

TI-2026-69281 Denial of service in Absolute Secure Access connection setup CVSS 4.0HIGH 8.7
TI-2026-25841 Memory management vulnerability in Secure Access servers CVSS 4.0HIGH 8.7
TI-2026-84098 Cross-site request forgery in Absolute Security Secure Access server CVSS 4.0CRITICAL 9.4
TI-2018-11965 An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. CVSS 3.0HIGH 8.8
TI-2026-39972 Out-of-bounds read in Absolute Security Secure Access CVSS 4.0HIGH 8.7
TI-2026-29603 Privilge misconfiguration in Secure Access installers CVSS 4.0HIGH 8.5

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences