Absolute Secure Access

DoS in Secure Access < 14.12 via crafted packet
CVE-2025-59595 - November 04, 2025

CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash.

Improper Input Validation

Excess Perms in Absolute Secure Access <14.10 Warehouse allows local file read
CVE-2025-54086 - October 02, 2025

CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability.

Incorrect Default Permissions

Priv Esc in Absolute Secure Access <13.56 via Console Permission Bypass
CVE-2025-49082 2.7 - Low - July 31, 2025

CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read other settings. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality is low, there is no impact to system availability or integrity.

Deserialization RCE in Absolute Secure Access Console (pre-13.56)
CVE-2025-49083 7.2 - High - July 31, 2025

CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administrative access to the console can cause unsafe content to be deserialized and executed in the security context of the console. The attack complexity is low and there are no attack requirements. Privileges required are high and there is no user interaction required. The impact to confidentiality is low, impact to integrity is high and there is no impact to availability. The impact to the confidentiality and integrity of subsequent systems is low and there is no subsequent system impact to availability.

Absolute Secure Access <=13.56 – Privilege Escalation via Policy Overwrite
CVE-2025-49084 9.1 - Critical - July 31, 2025

CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements are present, privileges required are high and no user interaction is required. There is no impact to confidentiality, the impact to integrity is low, and there is no impact to availability. The impact to confidentiality and availability of subsequent systems is high and the impact to the integrity of subsequent systems is low.

Absolute Secure Access <13.56 Priv Esc via Admin Console Bypass
CVE-2025-54085 3.8 - Low - July 31, 2025

CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read or change other settings. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality and integrity is low, there is no impact to system availability.

Absolute Secure Access <13.55 Warehouse Input Validation DoS
CVE-2025-49081 4.9 - Medium - June 12, 2025

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse over the network. The attack complexity is low, there are no attack requirements, privileges required are high, and there is no user interaction required. There is no impact on confidentiality or integrity; the impact on availability is high.

Absolute Secure Access Server 9.0-13.54 Memory Management DoS (Net)
CVE-2025-49080 7.5 - High - June 12, 2025

There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.

Absolute Secure Access Pre-13.54 Priv Escalation via Admin Console
CVE-2025-27703 6 - Medium - May 28, 2025

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features in the console. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality is low, the impact to system integrity is high and the impact to system availability is low.

XSS in Absolute Secure Access Console prior to v13.54
CVE-2025-27706 3.4 - Low - May 28, 2025

CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with system administrator permissions can interfere with another system administrators use of the management console when the second administrator visits the page. Attack complexity is low, there are no preexisting attack requirements, privileges required are high and active user interaction is required. There is no impact on confidentiality, the impact on integrity is low and there is no impact on availability.

Absolute Secure Access <=13.53: Permission Bypass in Admin Console
CVE-2025-27702 4.9 - Medium - May 28, 2025

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly modify settings. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. There is no impact to system confidentiality or availability, impact to system integrity is high.

XSS Vulnerability in Absolute Secure Access <=13.53 admin console
CVE-2025-27705 - March 19, 2025

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with system administrator permissions can interfere with another system administrators use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are none, user interaction is required. The impact to confidentiality is low, the impact to availability is none, and the impact to system integrity is none.

XSS in Absolute Secure Access Admin Console <13.53
CVE-2025-27704 - March 19, 2025

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with system administrator permissions can interfere with another system administrators use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are none, user interaction is required. The impact to confidentiality is low, the impact to availability is none, and the impact to system integrity is none.

Absolute Secure Access XSS in Management Console Before v13.52
CVE-2024-40875 - December 20, 2024

There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator permissions can interfere with another system administrators use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are high, user interaction required is none. The impact to confidentiality is none, the impact to availability is low, and the impact to system integrity is high.

XSS in Absolute Secure Access <13.07 Console
CVE-2024-40873 3.4 - Low - July 25, 2024

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with system administrator permissions can interfere with another system administrators use of the publishing UI when the administrators are editing the same management object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high.

XSS

Elev. Privilege in Absolute Secure Access <13.07 via invalid address data
CVE-2024-40872 - July 25, 2024

There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, the impact to system confidentiality and integrity is high, the impact to the availability of the effected component is none.

XSS in Absolute Secure Access UI before v13.06 (admin-level)
CVE-2024-37349 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrators use of the management UI when the victim administrator edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS

Absolute Secure Access XSS in Policy UI <13.06
CVE-2024-37350 4.7 - Medium - June 20, 2024

There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrators use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the vulnerable component while the attacking administrator is authenticated to the console. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS

XSS in Absolute Secure Access <13.06 Management UI
CVE-2024-37351 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrators use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS

XSS in Absolute Secure Access UI <13.06 (Admin scope)
CVE-2024-37352 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administrator permissions to interfere with other system administrators use of the management UI when the second administrator accesses the vulnerable page. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS

ASA Warehouse int. val. flaw enables UI availability loss <13.06
CVE-2024-37346 4.9 - Medium - June 20, 2024

There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can impair the availability of certain elements of the Secure Access administrative UI by writing invalid data to the warehouse over the network. There is no loss of warehouse integrity or confidentiality, the security scope is unchanged. Loss of availability is high.

Absolute Secure Access <=13.06 XSS in admin UI
CVE-2024-37348 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrators use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS

Absolute Secure Access <=13.05 XSS in Admin Console
CVE-2024-37343 5.4 - Medium - June 20, 2024

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with valid tunnel credentials can pass a limited-length script to the administrative console which is then temporarily stored where an administrator using a non-default configuration could click on it while the attacker has a valid tunnel session with the server. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high.

XSS

Absolute Secure Access <=13.06 XSS in Policy Management UI
CVE-2024-37344 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrators use of the policy management UI when the administrators are editing the same policy object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high.

XSS

Absolute Secure Access <=13.06 XSS in admin UI stored payload
CVE-2024-37345 5.4 - Medium - June 20, 2024

There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a limited-length script to the administrative UI which is then stored where an administrator can access it. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high

XSS

Absolute Secure Access pool config XSS (pre13.06)
CVE-2024-37347 3.4 - Low - June 20, 2024

There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can pass a limited length script to be run by another administrator. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

XSS