{"id":"CVE-2026-97718","kind":"vulnerability","aliases":["CVE-2026-97718"],"related":[],"title":"Secure Access server: forged requests let an attacker create admin accounts","description":"CVE-2026-97718 Is a cross-site request forgery vulnerability\nin version 14.60 of the Secure Access server.  Because of a bypassed security control, an\nattacker can cause an admin to create an account under their control.","summary":"Version 14.60 of the Secure Access server has a cross-site request forgery flaw because a security control is bypassed. An attacker can trick an admin into creating an account the attacker controls.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Secure Access server","fixed":["14.61"],"affected":"14.60","ecosystem":"vendor"}],"ecosystems":[],"tags":["csrf","infrastructure","secure-access","self-hosted"],"not_affected_if":["managed-hosting","saas"],"how_to_check":"Check the Secure Access server version. Only 14.60 is affected; 14.61 contains the fix. Secure Access SaaS is not affected.","fix":"Upgrade Secure Access server to 14.61 (download from Absolute Community downloads section); Absolute recommends scheduling a maintenance window as soon as possible.","status":"open","published_at":"2026-11-02T20:18:05+00:00","first_seen_at":"2026-11-02T20:35:38+00:00","triaged_at":"2026-11-02T20:36:26+00:00","updated_at":"2026-11-02T20:37:18+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-02T20:36:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Secure Access server: forged requests let an attacker create admin accounts","impact":"high","summary":"Version 14.60 of the Secure Access server has a cross-site request forgery flaw because a security control is bypassed. An attacker can trick an admin into creating an account the attacker controls.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["secure-access","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker creates an admin account on the server","analyst_note":"Find the vendor advisory and the fixed version for Secure Access server 14.60 via the NVD link (https://nvd.nist.gov/vuln/detail/CVE-2026-97718).","how_to_check":"- Confirm the installed Secure Access server version and whether it is `14.60`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Secure Access server version 14.60 are exposed, and an admin must be tricked into acting on a malicious request. Sources do not say which deployments or configurations are affected beyond that version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000637,"input_tokens":4103,"output_tokens":454,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed version for Secure Access server 14.60 via the NVD link (https://nvd.nist.gov/vuln/detail/CVE-2026-97718).","search":"'-2026':13A,16A,64C '-97718':14A,17A,65C '14.60':30B,76C 'access':2A,19A,25B,34B,80C 'account':11A,59B,97C 'admin':10A,55B,93C 'attack':8A,51B,61B,89C 'bypass':49B,85C 'caus':91C 'control':47B,62B,87C,100C 'creat':9A,57B,95C 'cross':39B,69C 'cross-sit':38B,68C 'csrf':21B 'cve':12A,15A,63C 'flaw':43B 'forg':4A 'forgeri':42B,72C 'host':28B 'infrastructur':22B 'let':6A 'request':5A,41B,71C 'secur':1A,24B,33B,46B,79C,86C 'secure':18A 'secure-access':23B 'self':27B 'self-host':26B 'server':3A,20A,35B,81C 'site':40B,70C 'trick':53B 'version':29B,75C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Secure Access (formerly NetMotion) servers running exactly version 14.60 are affected. An attacker can use a forged request to get an admin to create an account under the attacker's control; this needs an admin to interact (user interaction required). Secure Access SaaS customers and other versions are not affected by this CVE (other CVEs fixed in 14.61 affect 13.0 through 14.60).","tier":"B","verified":{"fix":{"at":"2026-11-02T20:37:18Z","by":"analyst","doc":"https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-61-and-insights-for-network-4-51","run_id":1418},"products":{"at":"2026-11-02T20:37:18Z","by":"analyst","doc":"https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-61-and-insights-for-network-4-51","run_id":1418},"how_to_check":{"at":"2026-11-02T20:37:18Z","by":"analyst","doc":"https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-61-and-insights-for-network-4-51","run_id":1418},"who_affected":{"at":"2026-11-02T20:37:18Z","by":"analyst","doc":"https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-61-and-insights-for-network-4-51","run_id":1418}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["accessserver","secureaccessserver"],"ptokens":["access","secure","server"],"labels":["critical","csrf","infrastructure","secureaccess","selfhosted"],"first_public_at":"2026-11-02T20:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"SecurityResponse@netmotionsoftware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97718","severity":null,"published_at":"2026-11-02T20:18:05+00:00","modified_at":"2026-11-02T20:18:05+00:00","first_seen_at":"2026-11-02T20:35:38+00:00","fetched_at":"2026-11-02T20:35:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97718:1418","url":null,"severity":null,"published_at":"2026-11-02T20:37:18+00:00","modified_at":"2026-11-02T20:37:18+00:00","first_seen_at":"2026-11-02T20:37:18+00:00","fetched_at":"2026-11-02T20:37:18+00:00","note":"Absolute Security advisory (Oct 29 2026) read: 14.60 only, CVSS 4.0 9.4, fixed in Secure Access 14.61; SaaS not impacted. No exploitation or PoC stated; did not search social."}],"documents":[{"id":53781,"url":"https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718","title":"CVE-2026-97718 - Critical | Absolute Security","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53782,"url":"https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-61-and-insights-for-network-4-51","title":"Multiple Vulnerabilities Addressed in Secure Access 14.61 and Insights for Network 4.51","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}