EUVD-2026-44779Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privileged attacker (AV:L/PR:L) with full host impact; AC:H because exploitation depends on the non-default install condition, and scope stays on the same host (S:U).
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
3DescriptionCVE.org
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.
AnalysisAI
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-privileged local user to gain Administrator rights when the software is installed to a non-default directory, due to an insecure installer permission configuration. Absolute (formerly NetMotion) assigns this a CVSS 4.0 base score of 8.5 (High), reflecting full local compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Absolute Secure Access is an enterprise secure-connectivity/VPN and mobility platform (the product line formerly known as NetMotion Mobility) with both Windows client and server components. The flaw is a privilege misconfiguration introduced by the installer: when the product is placed in a non-default installation path, the directory or service ACLs are left overly permissive, so a standard local user can tamper with binaries, service paths, or files that a privileged (SYSTEM/Administrator) process later executes or trusts. Although the CWE is listed as N/A, the behavior maps to the classic weakness class of incorrect default/inherited permissions on installation directories (CWE-276/CWE-732-style), where a writable file or folder in the execution path of a high-privilege service becomes an escalation primitive.
RemediationAI
Vendor-released patch: version 14.55 - upgrade both the Windows client and server components of Absolute Secure Access to 14.55 or later, per the Absolute advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40952. As an interim compensating control where immediate patching is not possible, reinstall or relocate the software to the default installation path (which is not affected), since the flaw is tied to non-default install locations; alternatively, harden the ACLs on the non-default installation directory and its subfolders so that non-administrative users have no write/modify rights to the program files, service executables, or service configuration - noting the trade-off that manual ACL changes can be overwritten by future installer runs or break auto-update, so re-verify after any reinstall. Restrict interactive/local logon on affected servers and endpoints to trusted administrators to reduce the pool of accounts that could abuse the local vector.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today