Live › vulnerability › CVE-2026-97718
Version 14.60 of the Secure Access server has a cross-site request forgery flaw because a security control is bypassed. An attacker can trick an admin into creating an account the attacker controls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Self-hosted Secure Access (formerly NetMotion) servers running exactly version 14.60 are affected. An attacker can use a forged request to get an admin to create an account under the attacker's control; this needs an admin to interact (user interaction required). Secure Access SaaS customers and other versions are not affected by this CVE (other CVEs fixed in 14.61 affect 13.0 through 14.60).
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Secure Access server | vendor | 14.60 | 14.61 |
Upgrade Secure Access server to 14.61 (download from Absolute Community downloads section); Absolute recommends scheduling a maintenance window as soon as possible.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
This page as .md · .json · in your agent: get_signal("CVE-2026-97718")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.