CVE-2026-55979 Overview
CVE-2026-55979 is an improper access control vulnerability in the named pipe communication interface of CatchPulse, an endpoint protection product from SecureAge. A local authenticated attacker can invoke internal CatchPulse functions through the named pipe without passing the required access control checks. Exploitation is constrained to operations that enforce more restrictive security policies, limiting the scope of abuse.
The issue is tracked by the Cyber Security Agency of Singapore under advisory AL-2026-098 and disclosed by SecureAge. It maps to [CWE-284] Improper Access Control affecting local inter-process communication.
Critical Impact
A local user with low privileges can bypass access control on the CatchPulse named pipe and trigger security-policy operations that should be restricted to authorized callers.
Affected Products
- SecureAge CatchPulse endpoint protection
- CatchPulse named pipe communication interface
- Refer to the CSA Security Advisory AL-2026-098 for version details
Discovery Timeline
- 2026-08-06 - CVE-2026-55979 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-55979
Vulnerability Analysis
CatchPulse exposes a named pipe on Windows to broker requests between user-mode components and its protection service. The pipe endpoint accepts commands that map to internal CatchPulse functions, including operations that adjust or invoke security policy enforcement. The interface fails to validate that the calling process holds the required privileges for the requested function.
Because the access check is missing or insufficient, a local process running under a low-privileged user account can connect to the pipe and issue requests that the product should reject. The advisory constrains impact to operations tied to more restrictive security policies rather than full administrative control of the agent.
Root Cause
The root cause is an improper access control check on the server side of the named pipe. Authorization decisions rely on client-supplied context rather than on a validated caller identity or token inspection. As a result, the pipe treats untrusted callers as if they were authorized components of the CatchPulse product.
Attack Vector
Exploitation requires local access and a valid low-privileged account on the target host. No user interaction is needed. The attacker opens the CatchPulse named pipe, frames a request that targets a restricted function, and sends it to the service. The scope changes because the vulnerable service performs actions under its own elevated context on behalf of the caller.
No public proof-of-concept, exploit code, or CISA KEV listing is available for CVE-2026-55979 at the time of writing. Refer to the SecureAge Security Vulnerabilities Overview for vendor-specific technical detail.
Detection Methods for CVE-2026-55979
Indicators of Compromise
- Unexpected client processes opening handles to CatchPulse named pipes from non-product binaries or user-writable paths.
- CatchPulse service log entries showing policy-related function invocations that do not correlate with administrative activity or product updates.
- Sudden changes to CatchPulse policy state initiated from a standard user session.
Detection Strategies
- Monitor Windows named pipe creation and connection events (Sysmon Event IDs 17 and 18) filtered on pipe names associated with CatchPulse.
- Correlate pipe client process image paths against the expected set of signed CatchPulse binaries.
- Alert on non-CatchPulse processes issuing CreateFile or WriteFile operations against the product's pipe endpoint.
Monitoring Recommendations
- Enable Sysmon with a configuration that logs pipe events and forward the logs to a central analytics platform.
- Baseline legitimate CatchPulse policy changes and alert on out-of-band modifications from unprivileged users.
- Track CatchPulse service crashes, restarts, or configuration reloads following local logon events.
How to Mitigate CVE-2026-55979
Immediate Actions Required
- Apply the fixed CatchPulse build referenced in CSA Security Advisory AL-2026-098 as soon as it is available in your environment.
- Restrict interactive and remote local logon rights on endpoints running CatchPulse to reduce the pool of accounts capable of reaching the pipe.
- Audit local accounts and remove unnecessary standard user access on servers and shared workstations.
Patch Information
SecureAge has published vulnerability information through its Security Vulnerabilities Overview page. Consult the vendor advisory and the CSA alert for the exact fixed version of CatchPulse and upgrade guidance. No CPE ranges are enumerated in the current NVD record, so version identification should be confirmed against vendor documentation.
Workarounds
- Where patching is delayed, limit local logon and remote desktop access on affected endpoints to trusted administrators only.
- Deploy application control policies to prevent unapproved executables from running on hosts protected by CatchPulse.
- Monitor and alert on any process, other than CatchPulse components, that opens the product's named pipe.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
