EUVD-2026-44779Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliveryLocate non-default Secure Access install with weak ACLs
-
ExploitPlant or replace file in privileged execution path
-
ExecutionTrigger privileged service or process
-
ImpactExecute code as Administrator
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged local account (CVSS PR:L) with local access to the affected Windows client or server; no user interaction and no network reachability. The decisive prerequisite named in the advisory is that Secure Access must be installed in a NON-DEFAULT location - default-path installations are not stated to be exploitable, which is the primary limiting factor. Exploitation is further limited to versions prior to 14.55 on the Windows client/server components, and the attacker must already possess a local foothold, so it cannot be triggered remotely or by an unauthenticated actor. |
| Impact | The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: exploitation is local and requires an already-authenticated low-privileged foothold, but yields full high-impact compromise of the host. This is a credible post-compromise escalation issue rather than a remotely-reachable, mass-exploitable one - the local attack vector and PR:L requirement meaningfully cap real-world urgency compared to a network-facing CVSS-8.5. Key risk-lowering signals: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC is referenced. A notable limiting condition is that exploitation only applies when Secure Access is installed in a non-default location, so default-path deployments may not be affected. Bottom line: prioritize for endpoints/servers running non-default installs and where local user access is realistic (shared/multi-user hosts, servers with interactive low-priv accounts), but this is not a drop-everything internet-facing emergency. |
| Exploit ScenarioDerived | An attacker who already has an ordinary user account on a Windows host where Absolute Secure Access is installed to a non-default folder identifies a writable file or service path within that directory. They replace or plant a binary that the privileged Secure Access service or an Administrator-context process executes, causing their code to run with Administrator privileges. No public POC is referenced, but the low attack complexity means exploitation would be straightforward once the misconfigured install is located. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-privileged local user to gain Administrator rights when the software is installed to a non-default directory, due to an insecure installer permission configuration. Absolute (formerly NetMotion) assigns this a CVSS 4.0 base score of 8.5 (High), reflecting full local compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: version 14.55 - upgrade both the Windows client and server components of Absolute Secure Access to 14.55 or later, per the Absolute advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40952. As an interim compensating control where immediate patching is not possible, reinstall or relocate the software to the default installation path (which is not affected), since the flaw is tied to non-default install locations; alternatively, harden the ACLs on the non-default installation directory and its subfolders so that non-administrative users have no write/modify rights to the program files, service executables, or service configuration - noting the trade-off that manual ACL changes can be overwritten by future installer runs or break auto-update, so re-verify after any reinstall. Restrict interactive/local logon on affected servers and endpoints to trusted administrators to reduce the pool of accounts that could abuse the local vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Absolute Secure Access is an enterprise secure-connectivity/VPN and mobility platform (the product line formerly known as NetMotion Mobility) with both Windows client and server components. The flaw is a privilege misconfiguration introduced by the installer: when the product is placed in a non-default installation path, the directory or service ACLs are left overly permissive, so a standard local user can tamper with binaries, service paths, or files that a privileged (SYSTEM/Administrator) process later executes or trusts. Although the CWE is listed as N/A, the behavior maps to the classic weakness class of incorrect default/inherited permissions on installation directories (CWE-276/CWE-732-style), where a writable file or folder in the execution path of a high-privilege service becomes an escalation primitive.
Know when Secure Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N
Local low-privileged attacker (AV:L/PR:L) with full host impact; AC:H because exploitation depends on the non-default install condition, and scope stays on the same host (S:U).
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.
Executive ViewAI
Absolute Secure Access for Windows (versions before 14.55) contains a local privilege escalation vulnerability affecting both client and server installations. Low-privileged users can exploit insecure installer permissions to gain full Administrator access on affected systems, with particular risk for systems installed to non-default directories. All Windows infrastructure running these vulnerable versions faces direct risk of complete local system compromise affecting confidentiality, integrity, and availability.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing default-directory-only installation policies, implementing least-privilege local account controls via operating system settings, deploying endpoint detection and response (EDR) platforms to alert on privilege escalation attempts, restricting software installation and modification permissions through group policy or equivalent controls, and maintaining elevated monitoring and audit logging of privileged account activities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Secure Access
View allUnauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running vers
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to caus
CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12.
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
GitHub PoC
Exploit-DB