Local privilege escalation in SafeNet Authentication Client SACSrv
- Exploited
- No known exploitation
- Fix
- Fixed in 10.9 R3 Post GA (build 10.9.7954) or later
- Who is exposed
- Specific setups only
Do first: Upgrade to a fixed version: 10.9 R3 Post GA (build 10.9.7954) or later.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A local attacker with a low-privilege, non-administrator account on a system running SafeNet Authentication Client can exploit a flaw in its SACSrv service through the service interface to trigger a heap-based buffer overflow. Successful exploitation may allow arbitrary code execution with Local System privileges.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
cve.now Index
- Exploitation0/40No signal
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.3/10CVSS 7.3, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Upgrade to a fixed version: 10.9 R3 Post GA (build 10.9.7954) or later.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Thalesgroup Safenet Authentication Client Service
through 10.9.7449
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-112109
Is CVE-2026-112109 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-112109?
Safenet Authentication Client Service: through 10.9.7449.Source: cve.now feed data
How do I fix CVE-2026-112109?
Upgrade SafeNet Authentication Client to 10.9 R3 Post GA (build 10.9.7954) or later. The advisory gives this as the fix, and no workaround is listed.Source: cve.org