What is CVE-2025-49084?

CVE-2025-49084 is a critical-severity vulnerability in Absolute Secure_access, classified under Incorrect Default Permissions. CVSS score: 9.1/10. Published 2025-07-31.

How severe is CVE-2025-49084?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2025-49084 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Absolute Secure_access

CVE-2025-49084

CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low…

EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Absolute Secure_access
Absolutee Security Secure Access — versions 0

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

SecurityResponse@netmotionsoftware.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-49084?: CVE-2025-49084 is a critical-severity vulnerability in Absolute Secure_access, classified under Incorrect Default Permissions. CVSS score: 9.1/10. Published 2025-07-31.
How severe is CVE-2025-49084?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2025-49084 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.