What is CVE-2026-40952?

CVE-2026-40952 is a high-severity vulnerability in Absolute Secure Access, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2026-07-15.

How severe is CVE-2026-40952?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Absolute Secure Access

CVE-2026-40952

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.

EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Absolute Secure_access
Absolute Security Secure Access — versions 0
Microsoft Windows

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

SecurityResponse@netmotionsoftware.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-40952?: CVE-2026-40952 is a high-severity vulnerability in Absolute Secure Access, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2026-07-15.
How severe is CVE-2026-40952?: High severity. CVSS v3 base score is 7.8 out of 10.