{"id":"CVE-2026-116769","kind":"vulnerability","aliases":["CVE-2026-116769"],"related":[],"title":"Secure Access servers: authentication bypass lets attackers change client security settings","description":"CVE-2026-116769 is an authentication bypass\nvulnerability in Secure Access servers starting with version 13.0 and prior to\n14.61. Attackers can modify security settings of a client via the server.","summary":"Secure Access servers from version 13.0 before 14.61 contain an authentication bypass. An attacker can modify the security settings of a client through the server.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","secure-access","vpn"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Secure Access server version against the affected range (13.0 up to but not including 14.61)","fix":"- Move to a Secure Access server version at or above `14.61`","status":"open","published_at":"2026-11-02T20:17:33+00:00","first_seen_at":"2026-11-02T20:35:25+00:00","triaged_at":"2026-11-02T20:36:27+00:00","updated_at":"2026-11-02T20:36:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:36:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Secure Access server version at or above `14.61`","reach":"network","title":"Secure Access servers: authentication bypass lets attackers change client security settings","impact":"high","summary":"Secure Access servers from version 13.0 before 14.61 contain an authentication bypass. An attacker can modify the security settings of a client through the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["secure-access","vpn"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker bypasses authentication and changes client security settings","analyst_note":"Confirm the affected product name, the fixed-version details and the attack vector from the NVD entry or vendor advisory.","how_to_check":"- Check the installed Secure Access server version against the affected range (13.0 up to but not including 14.61)\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running Secure Access servers in the affected version range are exposed. The sources do not describe the deployment conditions beyond the version range, so the exact configuration needed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":4097,"output_tokens":448,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116769':14A,17A,50C '-2026':13A,16A,49C '13.0':28B,63C '14.61':30B,67C 'access':2A,21B,24B,58C 'attack':7A,36B,68C 'authent':4A,33B,53C 'bypass':5A,34B,54C 'chang':8A 'client':9A,44B,75C 'contain':31B 'cve':12A,15A,48C 'infrastructur':18B 'let':6A 'modifi':38B,70C 'prior':65C 'secur':1A,10A,20B,23B,40B,57C,71C 'secure-access':19B 'server':3A,25B,47B,59C,78C 'set':11A,41B,72C 'start':60C 'version':27B,62C 'via':76C 'vpn':22B 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Secure Access servers in the affected version range are exposed. The sources do not describe the deployment conditions beyond the version range, so the exact configuration needed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","secureaccess","vpn"],"first_public_at":"2026-11-02T20:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"SecurityResponse@netmotionsoftware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116769","severity":null,"published_at":"2026-11-02T20:17:33+00:00","modified_at":"2026-11-02T20:17:33+00:00","first_seen_at":"2026-11-02T20:35:25+00:00","fetched_at":"2026-11-02T20:35:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}