CVE-2026-97718 CSRF in Secure Access Server v14.60

CriticalCVSS 9.4 EPSS 0.19%

Published: 2026-11-02 22:00
Updated: 2026-11-06 20:18
Exploit status: No public exploit known

Description

CVE-2026-97718 Is a cross-site request forgery vulnerability
in version 14.60 of the Secure Access server. Because of a bypassed security control, an
attacker can cause an admin to create an account under their control.

Affected products

Product	Affected versions	Fixed in
Absolute Security Secure Access	= 14.60	No fix listed

References

www.absolute.com

CVSS v4.0

9.4 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: Passive
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (2)

v4.0 9.4 · absolute
v4.0 9.4 · securityresponse@netmotionsoftware.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.19% (percentile 8.9)
CWE: CWE-352 Cross-Site Request Forgery (CSRF)

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.