{"id":"CVE-2026-33451","aliases":["EUVD-2026-26423","GHSA-qfmc-f7rr-gf93"],"status":"published","title":"Arbitrary read/write vulnerability in Windows clients prior to 14.50","description":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00104,"percentile":0.01034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-04-30T20:08:03Z","modified":"2026-10-26T22:10:00Z","products":[{"vendor":"absolute","product":"secure_access"},{"vendor":"absolute software","product":"secure access"}],"references":[{"url":"https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33451","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33451"},{"url":"https://github.com/advisories/GHSA-qfmc-f7rr-gf93"}],"sources":{"cve":[{"id":"CVE-2026-33451","title":"Arbitrary read/write vulnerability in Windows clients prior to 14.50","description":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system.","status":"published","published":"2026-04-30T20:08:03.213Z","modified":"2026-05-01T14:36:19.832Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-26423","description":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system.","status":"published","published":"2026-04-30T20:08:03Z","modified":"2026-05-01T14:36:19Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-qfmc-f7rr-gf93","title":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client...","description":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system.","status":"published","published":"2026-04-30T21:30:38Z","modified":"2026-05-05T03:31:41Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:07:54.707151Z"}],"nvd":[{"id":"CVE-2026-33451","description":"CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system.","status":"published","published":"2026-04-30T21:16:31.8Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:16.626888Z"}]}}