CVE-2026-55978 Overview
CatchPulse contains an improper access control vulnerability in a kernel filter communication port. A non-administrative local attacker can connect to the unrestricted port and bypass the product's security policy enforcement. The flaw allows local, low-privileged users to interact directly with a kernel-level component intended for privileged use only. Successful exploitation compromises the integrity of endpoint protection controls and can disable or manipulate policy decisions made by the product.
Critical Impact
A local, low-privileged attacker can bypass CatchPulse security policy enforcement by communicating directly with an unrestricted kernel filter port, undermining endpoint protection integrity and availability.
Affected Products
- CatchPulse (SecureAge)
- Refer to the CSA Security Alert AL-2026-098 for version details
- Refer to the SecureAge Security Vulnerabilities Overview for vendor-published affected versions
Discovery Timeline
- 2026-08-06 - CVE-2026-55978 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-55978
Vulnerability Analysis
CatchPulse exposes a kernel filter communication port used by its user-mode components to coordinate with kernel-mode security enforcement. The port is not restricted to privileged callers. Any local process, including one running under a standard user account, can open a handle to the port and send messages to the kernel filter. This access allows the attacker to interact with security policy logic that should only be reachable by trusted, administrative components.
Because the port sits at the boundary between user mode and kernel-mode enforcement, unauthorized messages can influence or disable policy decisions. The attack requires local access and low privileges but does not require user interaction. Impact extends beyond the vulnerable process because the kernel filter enforces protection for the entire endpoint. This is classified as Improper Access Control on a kernel driver interface.
Root Cause
The root cause is a missing or insufficient access control descriptor on the kernel filter communication port. Windows filter communication ports created through FltCreateCommunicationPort accept a security descriptor argument that restricts which callers may connect. When the descriptor grants access to non-administrative principals, or when connection callbacks fail to validate the caller's token, any local process can attach to the port and issue filter messages.
Attack Vector
Exploitation is local and requires an authenticated session with low privileges. The attacker opens the exposed filter communication port from a standard user process and sends crafted messages to the CatchPulse kernel filter. Because the port bypasses normal administrative gating, the attacker can influence policy enforcement without requiring privilege escalation to SYSTEM or Administrator first. The scope change reflects that a compromise of one component (user-mode access) impacts a separate security authority (kernel-enforced policy).
No verified public exploit code is available. See the CSA Security Alert AL-2026-098 for advisory details.
Detection Methods for CVE-2026-55978
Indicators of Compromise
- Non-administrative processes obtaining handles to CatchPulse kernel filter communication ports
- Unexpected termination, restart, or policy state changes in CatchPulse services following local user activity
- Standard user processes loading libraries or invoking APIs associated with filter port communication such as FilterConnectCommunicationPort
Detection Strategies
- Monitor process activity for non-privileged callers invoking filter manager APIs targeting CatchPulse driver ports
- Alert on CatchPulse policy enforcement events that toggle, disable, or report tampering from a local session
- Correlate handle-open events on the CatchPulse filter port with the token integrity level of the calling process
Monitoring Recommendations
- Enable process creation and module load logging on endpoints running CatchPulse and forward events to a centralized analytics platform
- Track CatchPulse service health and configuration drift to identify silent policy bypass attempts
- Review endpoint telemetry for local privilege manipulation attempts preceding or following interaction with the kernel filter port
How to Mitigate CVE-2026-55978
Immediate Actions Required
- Inventory all endpoints running CatchPulse and identify installed versions against the vendor advisory
- Apply the vendor-supplied update from SecureAge as soon as it is available for your deployment
- Restrict local logon rights on systems where CatchPulse is deployed to reduce the population of potential local attackers
Patch Information
SecureAge tracks CatchPulse security updates on the SecureAge Security Vulnerabilities page. Consult the CSA Security Alert AL-2026-098 for guidance on affected versions and remediation steps. Deploy the fixed release across all managed endpoints and verify version reporting after installation.
Workarounds
- Limit interactive and remote local access to systems running CatchPulse to trusted administrators until patched
- Monitor and block untrusted processes from attempting to open handles to CatchPulse kernel filter communication ports
- Enforce application control policies that prevent execution of unauthorized binaries capable of interacting with kernel driver interfaces
# No vendor-published configuration workaround is available.
# Consult SecureAge advisory guidance before deploying custom mitigations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
