What is CVE-2025-54086?

CVE-2025-54086 is a low-severity vulnerability in Absolute Secure Access, classified under Incorrect Default Permissions. CVSS score: 3.3/10. Published 2025-10-02.

How severe is CVE-2025-54086?

Low severity. CVSS v3 base score is 3.3 out of 10.

Is CVE-2025-54086 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Absolute Secure Access

CVE-2025-54086

CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability.

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Absolute Secure_access
Absolute Security Secure Access — versions 0

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

SecurityResponse@netmotionsoftware.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-54086?: CVE-2025-54086 is a low-severity vulnerability in Absolute Secure Access, classified under Incorrect Default Permissions. CVSS score: 3.3/10. Published 2025-10-02.
How severe is CVE-2025-54086?: Low severity. CVSS v3 base score is 3.3 out of 10.
Is CVE-2025-54086 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.