EUVD-2026-53841
GHSA-547c-jxf5-rw6f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Local-only port access (AV:L), non-admin user sufficient (PR:L), kernel scope crossed (S:C), no confidentiality impact but full integrity and availability impact on security enforcement.
Primary rating from Vendor (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4).
CVSS VectorVendor: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
Lifecycle Timeline
2DescriptionCVE.org
An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement.
AnalysisAI
CatchPulse endpoint security software exposes an unrestricted kernel filter communication port that any non-administrative local user can connect to, enabling complete bypass of its security policy enforcement. The CVSS scope-changed vector (S:C, I:H, A:H) reflects that a low-privileged local user can subvert kernel-level security controls - effectively neutralizing the host's endpoint protection layer. No public exploit code has been identified at time of analysis, but the CSA Singapore advisory (AL-2026-098) indicates official government-level disclosure.
Technical ContextAI
CatchPulse is an endpoint protection product by SecureAge Technology. The vulnerability centers on Windows kernel filter communication ports - typically created via FltCreateCommunicationPort() in Windows Filter Manager architecture, which kernel-mode security drivers use to receive commands and policy updates from user-space components. When such a port is created without a security descriptor restricting access to administrators only, any authenticated local user process can call FilterConnectCommunicationPort() to establish a connection and send arbitrary messages to the kernel driver. The CWE is listed as N/A in the NVD entry, but the root cause class maps closely to CWE-284 (Improper Access Control) or CWE-732 (Incorrect Permission Assignment for Critical Resource), as the port lacks adequate discretionary access controls. The changed scope (S:C) in the CVSS vector confirms that exploitation crosses from the user security context into the kernel driver's authority domain.
RemediationAI
The primary remediation is to apply the vendor-supplied patch from SecureAge Technology. Consult the SecureAge security vulnerabilities page at https://www.secureage.com/security-vulnerabilities
for the specific patched version and update instructions, and reference CSA advisory AL-2026-098 at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-098/ for any additional guidance. An exact fixed version number is not confirmed from the available data - verify with the vendor directly before marking systems remediated. As a compensating control pending patch, administrators should restrict local user account privileges to the minimum necessary and audit which accounts have interactive logon rights on systems running CatchPulse, since the attack requires at minimum a low-privileged local session. Disabling interactive logins for non-essential accounts reduces the pool of potential attackers but does not eliminate the vulnerability for systems with multiple legitimate users.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today