Absolute Secure Access EUVD-2026-26423

Local interactive access or RDP session to a Windows endpoint running Absolute Secure Access client prior to version 14.50, with valid low-privilege user credentials (PR:L). The attacker must be able to execute code locally and interact with the Secure Access client's API interface, which appears to be accessible to standard users without requiring administrative privileges. No special configuration or non-default features are required - the vulnerability exists in standard installations. The local attack vector (AV:L) inherently limits exploitation to scenarios where the attacker has already established presence on the target system, either through prior compromise, physical access, or legitimate credentials. This fundamentally differs from remote vulnerabilities and constrains realistic risk to insider threats, supply chain compromises of user endpoints, or multi-stage attacks where initial access is achieved via separate vectors.

Real-world risk assessment presents moderate organizational risk with caveats. CVSS 4.0 base score of 8.5 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), but the local attack vector (AV:L) and low-privilege requirement (PR:L) significantly constrain exploitation scenarios to already-compromised endpoints or insider threats. The attack complexity is low (AC:L) and requires no user interaction (UI:N), meaning once an attacker has local access, exploitation is straightforward. Scope is unchanged (SC:N/SI:N/SA:N), indicating the vulnerability does not break security boundaries beyond the affected client. No EPSS data is available for risk quantification, and absence from CISA KEV indicates no confirmed active exploitation campaigns. However, privilege escalation vulnerabilities in enterprise security products are high-value targets for advanced persistent threats seeking to disable security controls and establish persistence. The 'Information Disclosure' tag suggests read primitive may expose credentials or keys. Priority depends on deployment: organizations with Secure Access deployed on sensitive workstations (finance, HR, executives) face higher risk than those using it only on standard endpoints. Patch availability in version 14.50 reduces urgency compared to unpatched vulnerabilities, but slow patch cycles in enterprise environments mean vulnerable versions may persist. SSVC framework assessment: exploitation status is none detected, automation potential is high given low complexity, technical impact is total system compromise-recommendation is Scheduled patching within standard maintenance cycles unless threat intelligence indicates targeting of Absolute products.

An attacker with valid low-privilege domain credentials compromises a standard user workstation through phishing or stolen credentials. They identify Absolute Secure Access client version 14.49 installed and craft malicious API payloads exploiting the arbitrary read/write vulnerability to read memory structures containing security tokens, then write shellcode into privileged process memory. The Secure Access client service running as SYSTEM executes the attacker's code, granting full administrative control of the endpoint. The attacker then disables security monitoring, extracts cached credentials from memory, and establishes persistence via scheduled tasks before pivoting to adjacent network resources.