EUVD-2026-53842
GHSA-7q9w-4j7c-8f3v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Local named-pipe IPC requires PR:L local session; scope changes because low-priv caller affects privileged CatchPulse service; impact bounded to limited disclosure and minor availability per vendor description.
Primary rating from Vendor (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4).
CVSS VectorVendor: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
Lifecycle Timeline
1DescriptionCVE.org
An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies.
AnalysisAI
CatchPulse's named pipe IPC interface exposes internal security functions without adequate caller authentication, enabling a low-privileged local attacker to invoke privileged operations within the endpoint security product. The vulnerability carries a CVSS 3.1 score of 5.2 (Medium) with a scope change component, indicating the attacker can affect the higher-privileged CatchPulse service process from a low-privilege context. No public exploit code or CISA KEV listing exists at time of analysis; impact is bounded by the vendor description to operations that apply more restrictive security policies, limiting the severity.
Technical ContextAI
Named pipes are a Windows inter-process communication (IPC) mechanism that allow processes to exchange data. CatchPulse, an endpoint security product developed by SecureAge, exposes an internal command interface via a named pipe. The root cause (CWE not formally assigned) is an improper access control check on the server side of this pipe - the service fails to validate that the connecting process has sufficient privilege or is a trusted caller before dispatching function invocations. The CVSS scope change (S:C) reflects the trust boundary crossing: a low-privilege user process successfully directs operations in CatchPulse, which runs at a higher privilege level. The CVSS vector AV:L/AC:L/PR:L confirms exploitation requires local system access but no elevated rights.
RemediationAI
Apply the vendor-supplied update for CatchPulse as detailed in the SecureAge security advisories at https://www.secureage.com/security-vulnerabilities. An exact patched version number was not present in the available intelligence; consult that page or the CSA Singapore alert at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-098/ for the precise fix version. As a compensating control where immediate patching is not possible, restrict local logon and terminal session access to the affected endpoint to trusted administrator accounts only, thereby eliminating the low-privilege attacker access prerequisite (PR:L). Additionally, security teams may monitor named pipe creation events targeting CatchPulse's pipe name using endpoint detection tooling to identify unauthorized connection attempts. These workarounds reduce exposure but do not eliminate the underlying access control defect.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today