CVE-2026-11459 Overview
CVE-2026-11459 is an information disclosure vulnerability in SecureAge CatchPulse versions up to 10.9.3. The flaw resides in an unspecified function within the saappctl.sys driver library, which handles I/O Control (IOCTL) requests. A local attacker with low privileges can manipulate the IOCTL handler to leak sensitive information from the affected system. The exploit has been publicly disclosed, increasing the risk of opportunistic use. SecureAge was contacted prior to disclosure but did not respond. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Local attackers can interact with the saappctl.sys IOCTL handler to disclose information from kernel or driver memory, aiding follow-on privilege escalation or evasion of endpoint defenses.
Affected Products
- SecureAge CatchPulse up to and including version 10.9.3
- Component: saappctl.sys kernel driver
- Subsystem: IOCTL Handler
Discovery Timeline
- 2026-06-07 - CVE-2026-11459 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11459
Vulnerability Analysis
The vulnerability exists in saappctl.sys, a kernel-mode driver shipped with SecureAge CatchPulse. Kernel drivers expose functionality to user mode through IOCTL codes dispatched via DeviceIoControl calls. When a process sends a crafted IOCTL request to the driver, the handler returns data that should not be accessible to unprivileged users. The outcome is unauthorized information disclosure from a security-sensitive process context. Because the issue lives in a signed antivirus driver, it can be reached from any local user session that can open a handle to the device object. Public proof-of-concept material exists in the GitHub PoC repository and an analysis by Jordan Higgins.
Root Cause
The root cause is insufficient validation or sanitization of data returned by an IOCTL handler in saappctl.sys. The driver appears to copy memory contents into the user-supplied output buffer without enforcing access boundaries or zeroing uninitialized regions. This matches the [CWE-200] pattern of exposing information to actors not entitled to receive it.
Attack Vector
Exploitation requires local access and a low-privileged authenticated session. An attacker opens a handle to the CatchPulse driver device and issues a specific DeviceIoControl request. The driver responds with data drawn from a privileged context, which the attacker reads from user space. No user interaction is required and the attack complexity is low. See the VulDB advisory for additional indexing details.
No verified exploit code is reproduced here. Refer to the linked PoC repository for technical reproduction details.
Detection Methods for CVE-2026-11459
Indicators of Compromise
- Unexpected user-mode processes opening handles to the \\.\ device object exposed by saappctl.sys.
- Repeated or anomalous DeviceIoControl calls targeting the CatchPulse driver from non-SecureAge processes.
- Presence of artifacts from the public PoC, including binaries or scripts referenced in the GitHub PoC repository.
Detection Strategies
- Monitor kernel driver interactions for unsigned or non-SecureAge processes invoking IOCTLs against saappctl.sys.
- Apply behavioral analytics to flag low-privilege users enumerating device objects associated with security products.
- Correlate suspicious IOCTL activity with subsequent privilege escalation attempts or credential access behaviors.
Monitoring Recommendations
- Enable Windows kernel auditing for driver load events and device object access where supported.
- Forward EDR telemetry covering DeviceIoControl and handle creation events to a centralized analytics pipeline.
- Establish a baseline of legitimate CatchPulse processes and alert on deviations from that baseline.
How to Mitigate CVE-2026-11459
Immediate Actions Required
- Inventory all endpoints running SecureAge CatchPulse 10.9.3 or earlier and prioritize remediation on multi-user systems.
- Restrict local logon rights on hosts running CatchPulse to reduce the population of users able to invoke the vulnerable IOCTL.
- Monitor SecureAge channels for a patch release, since the vendor did not respond to initial disclosure outreach.
Patch Information
No vendor patch has been published at the time of NVD entry on 2026-06-07. SecureAge did not respond to disclosure attempts. Track the VulDB entry for CVE-2026-11459 and official SecureAge advisories for fix availability.
Workarounds
- Limit CatchPulse deployment to single-user workstations where local low-privileged attackers are not present.
- Apply application allowlisting to prevent unauthorized binaries from issuing IOCTLs to the CatchPulse driver.
- Consider temporarily disabling or replacing the affected product on high-risk multi-user systems until a patch is released.
# Example: list installed driver and confirm version on Windows
sc query saappctl
powershell -Command "Get-ItemProperty 'C:\\Windows\\System32\\drivers\\saappctl.sys' | Select-Object VersionInfo"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
