CVE-2026-40952: Absolute Secure Access Privilege Escalation

CVE-2026-40952 Overview

CVE-2026-40952 is a privilege misconfiguration in the Absolute Secure Access installer for Windows client and server components. The flaw affects versions prior to 14.55 and stems from insecure default permissions [CWE-276] applied when the product is installed in a non-default location. A local authenticated attacker can leverage the weakness to escalate privileges to Administrator. The issue is tracked under CVSS 4.0 with a base score of 8.5 and requires only low privileges and local access to exploit.

Critical Impact
Local users on Windows systems running Absolute Secure Access installed to a non-default path can gain Administrator-level control, resulting in full compromise of the host.

Affected Products

Absolute Secure Access for Windows client (versions prior to 14.55)
Absolute Secure Access for Windows server (versions prior to 14.55)
Microsoft Windows hosts running vulnerable Secure Access installations

Discovery Timeline

2026-07-15 - CVE-2026-40952 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-40952

Vulnerability Analysis

The vulnerability resides in the installer logic of Absolute Secure Access on Windows. When an administrator selects a custom installation path rather than the default directory, the installer applies permissions that do not adequately restrict write or modify access on the installation folder and its contents. Standard users on the system can then tamper with executables, libraries, or service binaries that later run in a privileged context.

The weakness is categorized as [CWE-276] Incorrect Default Permissions. Exploitation requires local access and a valid low-privilege account. No user interaction is needed once the attacker is on the system. Successful abuse yields high impact to confidentiality, integrity, and availability of the host.

Root Cause

The installer does not enforce restrictive Access Control Lists (ACLs) on non-default installation directories. When Windows creates a folder outside protected paths such as C:\Program Files, it inherits permissions from the parent directory, which frequently grant Users or Authenticated Users write access. Absolute Secure Access installs privileged services and binaries into this location without explicitly hardening the ACLs.

Attack Vector

An attacker with local shell access identifies that Secure Access was installed to a non-default path such as D:\Apps\SecureAccess. The attacker replaces or modifies a binary or DLL loaded by a Secure Access service running as SYSTEM. When the service restarts or reloads the tampered file, the attacker's code executes with Administrator or SYSTEM privileges. Verified proof-of-concept code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-40952

Indicators of Compromise

Unexpected modifications to files under the Absolute Secure Access installation directory, especially executables, DLLs, or service configuration files.
New or altered scheduled tasks or services referencing binaries within a non-default Secure Access install path.
Process creation events where a Secure Access service spawns unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Audit ACLs on the Secure Access installation directory using icacls and flag any entry granting write access to non-administrative principals.
Correlate file-write events on Secure Access binaries with the identity of the writing process to detect tampering by non-privileged accounts.
Monitor for service restarts of Secure Access components immediately following file modifications in the install directory.

Monitoring Recommendations

Enable Windows Security event auditing for object access on the Secure Access installation folder and forward events to a central SIEM.
Track Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for activity within the Secure Access install path.
Alert on privilege changes to service accounts or new local administrators shortly after Secure Access file activity.

How to Mitigate CVE-2026-40952

Immediate Actions Required

Upgrade Absolute Secure Access Windows client and server to version 14.55 or later on all affected endpoints.
Inventory hosts to identify installations located outside the default C:\Program Files path and prioritize them for remediation.
Restrict interactive local logon on servers running Secure Access to reduce the population of accounts able to exploit the flaw.

Patch Information

Absolute has published fixed builds addressing this issue. Refer to the Absolute Security Vulnerability CVE-2026-40952 advisory for the authoritative patch matrix and download instructions. Apply version 14.55 or later to remediate.

Workarounds

Manually harden ACLs on the Secure Access installation directory to remove write and modify rights for non-administrative users.
Reinstall Secure Access to the default C:\Program Files location, which inherits restrictive Windows system permissions.
Enforce application allowlisting to prevent unauthorized binaries from executing from the Secure Access installation directory until patching is complete.

bash

# Example: audit and harden ACLs on a non-default Secure Access install path
icacls "D:\Apps\SecureAccess" /remove:g "Users"
icacls "D:\Apps\SecureAccess" /remove:g "Authenticated Users"
icacls "D:\Apps\SecureAccess" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "D:\Apps\SecureAccess" /inheritance:r