Absolute says Secure Access servers 13.0 to 14.60 have a critical authentication bypass, fixed in 14.61

Four days between Absolute's fix and the CVE records

Absolute dated its Secure Access 14.61 release notes and its security advisory 29 October 2026. The CVE records for two of the five flaws that advisory lists, CVE-2026-116769 and CVE-2026-97718, were published on 2 November 2026 at 20:06 and 20:00 UTC. That is four days after the date on the vendor's pages (derived from the printed dates), and the two records are 5 minutes 39 seconds apart (derived). A process driven by CVE feeds alone would have learned of a critical authentication bypass in a remote access product four days after, by Absolute's own dates, the fixed software was available to customers.

What that does not establish: that anyone has used either flaw, how many servers run an affected version, or which settings an attacker could change. At 11:26 UTC on 3 November 2026, CISA's Known Exploited Vulnerabilities catalogue (version 2026.10.30, 1,766 entries) listed neither CVE, and neither CVE record carries a CISA assessment block. Absolute's pages say nothing about exploitation either way.

What Absolute does say is short. CVE-2026-116769 is "an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61", and "Attackers can modify security settings of a client via the server." Absolute, acting as its own CVE numbering authority, scores it 9.3, critical, on CVSS 4.0. CVE-2026-97718 is a cross site request forgery in version 14.60 only, where "an attacker can cause an admin to create an account under their control", scored 9.4, critical. Absolute's advisory says both are addressed in Secure Access 14.61, that "Secure Access SaaS customers are not impacted by these vulnerabilities", and that self hosted customers should schedule a maintenance window "as soon as possible".

This briefing is built from the primaries: the two CVE records, Absolute's own pages for each CVE, its 14.61 and 14.60 advisories and release notes, the product page, the GitHub and NVD copies, the CISA catalogue and the CVSS 4.0 specification, read from about 11:24 to 11:33 UTC on 3 November 2026. The release notes sit in a script driven community portal that a plain download cannot read, so they were read in a real browser tab and saved as text. Nothing was downloaded from Absolute's software area, no form was filled in, and this site did not run or test the software.

What Secure Access is, in Absolute's words

Absolute's Secure Access page calls it "a product suite" delivering "secure, resilient, Zero Trust connections to private apps, cloud services, and websites". The suite starts, the page says, with "a self-healing, intelligent client that acts as a distributed firewall", and comes in three editions: Core, Edge and Enterprise. Absolute's vulnerability archive says Secure Access and Insights for Network were "formerly Mobility and Mobile IQ", and an older notice names the product "NetMotion Mobility/Absolute Secure Access".

The records speak of "Secure Access servers". The pages read give pieces of what that server holds: the 14.61 notes mention a "web console UI", the 14.60 notes list "multiple authentication profiles for console login" and a "new REST API with modern OAuth authentication", and the eMudhra advisory separates "Absolute Secure Access self-hosted" from the cloud service. None of those pages defines in one sentence what the server does, or which of its interfaces faces clients and which faces administrators. That gap matters in the next section.

The two records side by side

Two readings of the vectors need care, and both are this site's reading of the CVSS 4.0 specification, not Absolute's words. First, the specification says a "None" rating for impact on a subsequent system means no loss there, or that all impact "is constrained to the Vulnerable System". The bypass record rates the subsequent system's confidentiality and integrity high, so the scorer is saying the damage lands beyond the server, which fits a description in which a client is changed through it. The record names no client, though. Second, the specification describes the passive value of user interaction as "limited interaction by the targeted user" that is "involuntary", and lists most cross site request forgery among its examples. So "passive" in the second record means a person's browser has to be involved, not that nobody is.

What "modify security settings of a client via the server" does and does not say

"Authentication bypass" is Absolute's label, and the record gives no weakness type to back or narrow it. The word the vector adds is "privileges required: none": no account is needed. The sentence that does the work is "Attackers can modify security settings of a client via the server." It leaves open which settings, which clients, and which door. It does not say whether the caller reaches the administrator's web console or the service the clients connect to, and nothing in the primaries says how many clients one server manages.

The product page gives a reason to ask which settings. If the client really is "a distributed firewall", then a security setting on it may be a protective one. That is inference, and the record says none of it. The integrity impact on the vulnerable system is rated high, which says the server's own data can be changed, and the subsequent system rating says something further out is affected too. Neither tells a defender which setting to look at.

The version range gives one useful limit. The bypass is recorded from 13.0, so it was not introduced by the features the 14.60 release notes list, such as the new REST API or the multiple console login profiles. The second flaw is different: it is recorded for 14.60 only, and the records do not say whether it sits in any of those new features.

Zoom

The request forgery: one version, one administrator's browser

The second record reads: "Because of a bypassed security control, an attacker can cause an admin to create an account under their control." The control is not named, so this briefing cannot say whether it is a request origin check, a token, a cookie rule or something else. The outcome is named: a new account the attacker controls. What access that account would have, and whether it is an administrator account, is not stated. The score treats everything as at risk, with all six impact ratings high.

14.60 was released on 7 October, by the date on its release notes, and 14.61 on 29 October, a gap of 22 days between the two releases (derived). The identifier CVE-2026-97718 sits next to the four identifiers Absolute listed as fixed in 14.60, CVE-2026-97714 to 97717, and was reserved on 24 September, 13 days before 14.60 shipped (derived). A reservation date is not a discovery date, and the record's source field says discovery is "UNKNOWN", so none of this says when the forgery was found.

One practical consequence follows from the two ranges. A server on 14.60 is in scope for both flaws, the bypass (13.0 through 14.60) and the forgery (14.60 only), and both are listed as addressed in the same release.

Which versions, and does 14.61 cover both?

Absolute's advisory for 14.61 prints the ranges as: CVE-2026-97718 "Impacts version 14.60 only"; CVE-2026-116769 "Impacts versions 13.0 through 14.60". The record for the bypass says 13.0 up to but not including 14.61, which is the same set. The record for the forgery lists only 14.60 and no fixed version, and the advisory and release notes supply the rest: both CVEs sit under "addressed in Secure Access 14.61", and the 14.61 release notes say the highest CVSS score among the fixes is 9.4, which matches the forgery. So the answer to whether 14.61 fixes both is yes, on Absolute's pages, and the fixed version is stated only in Absolute's text, not in the machine readable record of the forgery.

Two data quality points for anyone matching records to inventories. The records for the two flaws name the vendor "Absolute Security", while the records for three other 14.61 flaws name it "Absolute Software" (derived from reading all five). And the middle of the bypass range is not itemised: no record lists the releases between 13.0 and 14.60, so a tool needs Absolute's own version scheme to decide where a server falls.

Zoom

Dates: reserved, fixed, published

Derived from those dates: four days from 29 October to the records; 35 days from reserving CVE-2026-97718 to the fix and 39 to its record; 3 days from reserving CVE-2026-116769 to the fix and 7 to its record; and 27 minutes 11 seconds from the first of the five records to the last. Absolute's security page says "Once fixes are available, we release details of the vulnerabilities", and the sequence fits that: the fixed release came first, the write up after. One caution. The per CVE pages are dated 29 October, but the site stamp in their source reads 2 November 16:31 UTC, so this briefing can confirm they were live by 2 November and cannot confirm they were live on 29 October. The 14.61 advisory page carries the same 29 October date and lists all five CVE numbers.

What Absolute tells customers to do, and what it does not

The advisory says: "Absolute recommends that Secure Access customers schedule a maintenance window as soon as possible to update servers to 14.61 and Insights for Network to 4.51." It adds that software is in the downloads section of the Absolute Community, and that "Secure Access SaaS customers are not impacted". Self hosted servers are therefore the whole exposure on Absolute's account.

No page read prints a workaround, a configuration change, a detection method or a log to check, and none says what an administrator should look at after updating. The records give no credit line and no solution field. The 14.61 release also carries three further flaws, listed below, and the mitigation for the eMudhra certificate compromise, so one maintenance window covers more than these two CVEs.

Is anyone using these, and how many servers are exposed?

On the record, no signal either way. CISA's catalogue (version 2026.10.30, released 30 October 17:02 UTC) lists neither CVE, and was the latest at 11:26 UTC on 3 November; it can change at any time, so check it. Neither CVE record has a container from CISA, so there is no exploitation or automation rating. Both vectors leave exploit maturity at "not defined". NVD shows both as "Received", with no NVD analysis. GitHub's two advisories are unreviewed and list no affected package.

How many Secure Access servers face the internet, or any network at all, is not stated anywhere read, and no internet scan data was read for this briefing. A network attack vector in the score describes where an attacker can be, not where servers are. The question of who is exposed belongs to each operator's inventory.

What is stated, and what is not

What to do, in order

Technical details

The primaries print descriptions, scores, version ranges and dates. They print no indicators, no log lines, no requests, no configuration to set and no detection rules, and this briefing adds none. What follows is what they do print, copied exactly except where noted, so a defender can feed it to an inventory or scanner.

The two descriptions, as the CVE.org records print them. Line breaks are the record's own.

CVE-2026-116769 is an authentication bypass
vulnerability in Secure Access servers starting with version 13.0 and prior to
14.61. Attackers can modify security settings of a client via the server.

CVE-2026-97718 Is a cross-site request forgery vulnerability
in version 14.60 of the Secure Access server. Because of a bypassed security control, an
attacker can cause an admin to create an account under their control.

The CVSS 4.0 vectors and scores, as Absolute assigned them in each record. Paste them into a CVSS 4.0 calculator to see each metric in turn.

CVE-2026-116769  9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

CVE-2026-97718  9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The affected product data the records print, and the same ranges as Absolute's 14.61 advisory prints them.

CVE-2026-116769
  vendor: Absolute Security
  product: Secure Access
  status: affected
  version: 13.0
  lessThan: 14.61
  versionType: Server
  defaultStatus: unaffected

CVE-2026-97718
  vendor: Absolute Security
  product: Secure Access
  status: affected
  version: 14.60
  defaultStatus: unaffected

Absolute recommends that Secure Access customers schedule a maintenance window as soon as possible to update servers to 14.61 and Insights for Network to 4.51.

Absolute CVEs addressed in Secure Access 14.61:
CVE-2026-97718: 9.4, Critical (Impacts version 14.60 only)
CVE-2026-116769: 9.3, Critical (Impacts versions 13.0 through 14.60)
CVE-2026-116766: 8.3, High (Impacts versions 13.0 through 14.60)
CVE-2026-116767: 7.1, High (Impacts all versions through 14.60)
CVE-2026-116768: 7.1 High (Impacts all versions through 14.60)

Secure Access SaaS customers are not impacted by these vulnerabilities.

CVE-2026-97718   dateReserved 2026-09-24T22:30:33Z   datePublished 2026-11-02T20:00:40Z
CVE-2026-116769  dateReserved 2026-10-26T21:43:51Z   datePublished 2026-11-02T20:06:19Z
CVE-2026-116766  dateReserved 2026-10-26T21:43:51Z   datePublished 2026-11-02T20:16:26Z
CVE-2026-116767  dateReserved 2026-10-26T21:43:51Z   datePublished 2026-11-02T20:23:10Z
CVE-2026-116768  dateReserved 2026-10-26T21:43:51Z   datePublished 2026-11-02T20:27:51Z

Absolute 14.61 release notes and advisory: Oct 29, 2026
Absolute 14.60 release notes and advisory: Oct 7, 2026

catalogVersion: 2026.10.30   dateReleased: 2026-10-30T17:02:45Z   count: 1766
CVE-2026-116769 in catalogue: no
CVE-2026-97718 in catalogue: no
Any entry naming Absolute or NetMotion: none

The question that exposes the gap

If a caller with no account can change the security settings of your clients through your own server, which of those settings would you notice changing, who would see it, and how long ago would the change have to happen before your records ran out? Absolute's pages answer none of the three, so the answers have to come from your own server logs and your own change history.

Key facts