EUVD-2026-115456
GHSA-2v8x-56rq-wmw5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Secure Access server over network
-
ExploitInvoke endpoint bypassing authentication
-
ExecutionModify client security settings via server
-
ImpactWeaken downstream client security posture
Vulnerability Assessment
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against affected Secure Access servers (version 13.0 up to but not including 14.61), consistent with AV:N/AC:L/AT:N/PR:N/UI:N. The attacker must be able to reach the Secure Access server over the network; as a VPN/secure-access gateway this component is commonly internet-facing, which raises exposure. Exploitation is limited to the affected branch (>=13.0 and <14.61) - upgrading to 14.61 removes the affected code path. The precise trigger mechanism for the authentication bypass is not described in the available sources. |
| Impact | This is a genuine priority, not a high-CVSS-but-low-risk issue. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, and the vuln.today Decision label is act_now. Impact is concentrated on integrity: VI:H on the vulnerable system plus subsequent-system SI:H/SC:H, reflecting that the server can be abused to tamper with a client's security settings. Several key exploitation signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so exploitation status is 'no public exploit identified at time of analysis.' Note a minor internal inconsistency to verify with the vendor: the 4.0 vector asserts subsequent-system confidentiality impact (SC:H), yet the description characterizes the flaw purely as modifying (not reading) client security settings - an integrity action. The act_now label combined with an unauthenticated network vector on what is a VPN/secure-access gateway justifies urgent patching despite the absence of EPSS/KEV data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches an exposed Absolute/NetMotion Secure Access server (version 13.0 up to but not including 14.61) over the network and abuses the authentication bypass to push or alter security settings on a managed client. By weakening or overriding client-side security policy through the trusted server, the attacker degrades the client's protection posture. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Unauthenticated remote attackers can alter client security settings through affected Absolute Secure Access servers running version 13.0 up to but not including 14.61, an authentication bypass rated 9.3 critical with a vuln.today priority of act_now. The affected component is a VPN/secure-access gateway that is commonly internet-facing, so exposure is highest where the server is reachable over the network; upgrading to 14.61 removes the affected code path. No public exploit was identified at time of analysis.
RemediationAI
Upgrade Absolute Secure Access servers to version 14.61, the fixed release identified by the supplied affected-version range; the independent assessment states that upgrading to 14.61 removes the affected code path. The vendor advisory is at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116769. No workaround is described in the available sources, and the evidence does not state any alternative mitigation beyond updating to the fixed release. Prioritize internet-facing servers because exploitation requires network reachability to the affected branch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Absolute Secure Access is a VPN/secure-access gateway, and the flaw is an authentication bypass in server versions 13.0 through releases before 14.61. The CVSS 4.0 vector shows network reachability, low attack complexity, no privileges required, no user interaction, no confidentiality impact, high integrity impact on the vulnerable system, high subsequent-system integrity impact, and a scope change; the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. CWE is not supplied, so the root-cause class is unmapped, and the available sources do not describe the precise trigger mechanism. The integrity impact is consistent with the stated ability to modify a client’s security settings via the server.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
Remote, unauthenticated, low-complexity bypass (AV:N/AC:L/PR:N/UI:N); server altering a client's settings is a scope change (S:C) with high integrity impact and no confidentiality or availability impact.
Primary rating from Vendor (netmotionsoftware).
CVSS VectorVendor: netmotionsoftware
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
Executive ViewAI
CVE-2026-116769 is a critical authentication bypass in Absolute Secure Access (VPN gateway) versions 13.0 through 14.60, allowing unauthenticated attackers to alter client security settings and potentially compromise remote access. The product is commonly internet-facing, so leadership should prioritize immediate action to prevent unauthorized configuration changes that could weaken endpoint security and expose sensitive data. No public exploit has been identified, but the severity and exposure demand urgent remediation.
Apply vendor patch (upgrade to 14.61). If patching is delayed, restrict network access to the management interface, enforce strict firewall rules, and enable logging and alerting for configuration changes; consider temporary disablement of remote access features if risk is unacceptable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB