Absolute
Monthly
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthenticated attackers can crash the server by sending specially crafted packets. This vulnerability requires no user interaction and is easily exploitable over the network, though no patch is currently available. Organizations running affected versions should implement network-level mitigations to restrict access to the vulnerable service.
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. No public exploit code or active exploitation has been identified at time of analysis; vendor patch at version 14.57 addresses the flaw.
Secure Access versions up to 14.20 is affected by insertion of sensitive information into log file (CVSS 3.4).
Secure Access versions before 14.20 contain a stored cross-site scripting vulnerability that allows administrators to inject malicious scripts into the console interface. An authenticated admin can exploit this to interfere with other administrators' sessions and potentially steal sensitive information through the compromised console. The vulnerability requires high privileges and user interaction but can impact multiple administrators due to its scope across the application.
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting flaw in Absolute Secure Access (formerly NetMotion) versions prior to 14.10 lets an attacker who already holds high-level administrative access to the management console interfere with a second administrator's console session when that victim actively interacts with attacker-influenced content. This is an admin-to-admin stored/reflected XSS: exploitation requires both high privileges (PR:H) and victim participation (UI:A), and it is bounded to low integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.02%, 6th percentile), so the practical risk is low and prioritization can reflect that.
An open-redirect flaw (CWE-601) in Absolute Secure Access versions prior to 14.10 lets an attacker who can author a crafted URL through the Secure Access console bounce a victim to an arbitrary external site. Exploitation is not self-propagating: it requires the victim to actively click the crafted link (UI:A) and a non-trivial precondition flagged as AT:P, making it a phishing/social-engineering aid rather than a direct compromise of the product. Despite a CVSS v4.0 base of 5.5 and downstream (subsequent-system) impact ratings of High, no public exploit code has been identified at time of analysis, EPSS is only 0.03% (8th percentile), and there is no CISA KEV listing - indicating low real-world priority, with the primary risk being credential-phishing chains that abuse the vendor's trusted domain.
Server-side request forgery in Absolute Secure Access prior to 14.10 lets an administrator use the product's test HTTP request / publish feature to make the Secure Access server issue an attacker-crafted request to an internal or arbitrary destination. Exploitation requires an authenticated account with administrative privileges (CVSS PR:H), carries high attack complexity (AC:H), and requires active user interaction (UI:A), so it is only reachable by someone who already holds elevated control of the server. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile); the only downstream impact is a low-integrity effect on subsequent systems, with no confidentiality or availability loss.
Absolute Secure Access deployments prior to version 14.10 ship a Warehouse component whose Java keystore file is written with overly permissive filesystem permissions, letting any local account read its contents. Exploitation is local, not remote: an attacker must already hold low-privileged access to the host and the version must predate 14.10, and success yields only keystore disclosure (confidentiality low, no integrity or availability impact) rather than code execution or privilege escalation. EPSS is negligible (0.03%, 8th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor has released a fix, so this is a low-priority information-disclosure issue.
There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse over the network. The attack complexity is low, there are no attack requirements, privileges required are high, and there is no user interaction required. There is no impact on confidentiality or integrity; the impact on availability is high.
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated, network-based attackers to trigger a Denial of Service condition by sending specially crafted packet sequences. The vulnerability requires no privileges or user interaction and has high availability impact (complete service disruption), though no data confidentiality or integrity risk. This is a critical operational risk for organizations dependent on Absolute Secure Access for remote connectivity.
CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. Rated medium severity (CVSS 6.9). No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administrator permissions to interfere with other. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthenticated attackers can crash the server by sending specially crafted packets. This vulnerability requires no user interaction and is easily exploitable over the network, though no patch is currently available. Organizations running affected versions should implement network-level mitigations to restrict access to the vulnerable service.
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. No public exploit code or active exploitation has been identified at time of analysis; vendor patch at version 14.57 addresses the flaw.
Secure Access versions up to 14.20 is affected by insertion of sensitive information into log file (CVSS 3.4).
Secure Access versions before 14.20 contain a stored cross-site scripting vulnerability that allows administrators to inject malicious scripts into the console interface. An authenticated admin can exploit this to interfere with other administrators' sessions and potentially steal sensitive information through the compromised console. The vulnerability requires high privileges and user interaction but can impact multiple administrators due to its scope across the application.
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting flaw in Absolute Secure Access (formerly NetMotion) versions prior to 14.10 lets an attacker who already holds high-level administrative access to the management console interfere with a second administrator's console session when that victim actively interacts with attacker-influenced content. This is an admin-to-admin stored/reflected XSS: exploitation requires both high privileges (PR:H) and victim participation (UI:A), and it is bounded to low integrity impact with no confidentiality or availability consequence. No public exploit code has been identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.02%, 6th percentile), so the practical risk is low and prioritization can reflect that.
An open-redirect flaw (CWE-601) in Absolute Secure Access versions prior to 14.10 lets an attacker who can author a crafted URL through the Secure Access console bounce a victim to an arbitrary external site. Exploitation is not self-propagating: it requires the victim to actively click the crafted link (UI:A) and a non-trivial precondition flagged as AT:P, making it a phishing/social-engineering aid rather than a direct compromise of the product. Despite a CVSS v4.0 base of 5.5 and downstream (subsequent-system) impact ratings of High, no public exploit code has been identified at time of analysis, EPSS is only 0.03% (8th percentile), and there is no CISA KEV listing - indicating low real-world priority, with the primary risk being credential-phishing chains that abuse the vendor's trusted domain.
Server-side request forgery in Absolute Secure Access prior to 14.10 lets an administrator use the product's test HTTP request / publish feature to make the Secure Access server issue an attacker-crafted request to an internal or arbitrary destination. Exploitation requires an authenticated account with administrative privileges (CVSS PR:H), carries high attack complexity (AC:H), and requires active user interaction (UI:A), so it is only reachable by someone who already holds elevated control of the server. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile); the only downstream impact is a low-integrity effect on subsequent systems, with no confidentiality or availability loss.
Absolute Secure Access deployments prior to version 14.10 ship a Warehouse component whose Java keystore file is written with overly permissive filesystem permissions, letting any local account read its contents. Exploitation is local, not remote: an attacker must already hold low-privileged access to the host and the version must predate 14.10, and success yields only keystore disclosure (confidentiality low, no integrity or availability impact) rather than code execution or privilege escalation. EPSS is negligible (0.03%, 8th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor has released a fix, so this is a low-priority information-disclosure issue.
There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse over the network. The attack complexity is low, there are no attack requirements, privileges required are high, and there is no user interaction required. There is no impact on confidentiality or integrity; the impact on availability is high.
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated, network-based attackers to trigger a Denial of Service condition by sending specially crafted packet sequences. The vulnerability requires no privileges or user interaction and has high availability impact (complete service disruption), though no data confidentiality or integrity risk. This is a critical operational risk for organizations dependent on Absolute Secure Access for remote connectivity.
CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. Rated medium severity (CVSS 6.9). No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administrator permissions to interfere with other. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.