How to fix CVE-2026-97718 in Absolute Secure Access
Upgrade self-hosted Absolute Secure Access Server 14.60 to 14.61, and review administrative accounts created during the affected deployment period. CVE-2026-97718 is a cross-site request forgery vulnerability that can cause an administrator to create an account controlled by an attacker.
The individual advisory says 14.60 is the only affected version and assigns CVSS 4.0 9.4. The attack involves administrator interaction; the vector is not a claim of a zero-click compromise. Absolute's release advisory explicitly includes this CVE in the 14.61 fixes and says Secure Access SaaS customers are not impacted.
Confirm the server version and review accounts
Inventory the version on every Secure Access server and identify whether the installation is self-hosted or Absolute's SaaS service. The vulnerable component is the server; updating only a client does not fix it.
| Finding | Next step |
|---|---|
| Self-hosted server 14.60 | Upgrade to 14.61 or a later supported fixed release |
| Another server version | The vendor does not list it as affected by this CVE; assess its other advisories separately |
| Secure Access SaaS | The vendor says SaaS is not impacted by these vulnerabilities |
Review accounts, role assignments and administrative audit activity against approved changes. Investigate accounts whose owner or creation cannot be explained. Preserve relevant logs before removing unauthorized access under your incident-response process. The update prevents the reported defect from remaining in the software; it does not establish that existing accounts are legitimate.
Back up before changing the deployment
Download the server package from Absolute Community, and check the server requirements, license and upgrade considerations for the installed components.
Use the Warehouse backup procedure before upgrading. On the Warehouse host, open Secure Access Management Tool → Warehouse → Backup Data, supply the Warehouse password and select a protected destination. The resulting LDIF contains sensitive configuration; restrict access and encrypt its storage.
Confirm that the backup can support the intended recovery procedure. Keep the Warehouse password available to the authorized installer and maintain an administrative connection independent of the VPN. Warehouse installation requires direct local Administrators membership, and an in-place upgrade keeps the existing installation drive.
Upgrade a single host or the complete pool
The 14.61 release history identifies server build 02797. Verify the server package, rather than assuming that an Android client release carrying “14.61” is interchangeable.
For a Small Deployment Server with all components on one host, use the vendor's collocated upgrade. Run Setup on that computer, follow its detected-component upgrade flow and complete the installation. This updates its Server, Publisher and Warehouse together. A multi-server installation requires the distributed procedure.
For distributed components, follow the documented upgrade order:
- Upgrade the Warehouses individually, keeping another Warehouse available where the topology provides one.
- Upgrade the Publisher. The vendor requires its Secure Access version to match the servers.
- For each server, use the pool upgrade procedure: take it offline, fail its clients over to an available member, install the update on that host, then return it online.
- Complete the remaining members and verify the whole deployment before closing the change.
Take older members offline from their own hosts during a mixed-version transition. Check available capacity before moving clients; do not assume a single-server installation can provide uninterrupted access. Follow the compatibility plan for client and Insights for Network components where present.
Verify patching and administrative control
| Check | Expected result |
|---|---|
| Server inventory | Every previously affected 14.60 server now runs 14.61/build 02797 or an identified later fixed release |
| Account audit | Account ownership, roles and recent creation events match approved administration, or are investigated |
| Normal administration | An authorized administrator can perform an approved test account lifecycle with the intended role limits |
| User access | Representative users authenticate and access permitted resources; unauthorized access remains denied |
| Deployment health | Warehouses, pool membership, client reconnection and Publisher reporting operate as expected |
Perform account-lifecycle checks with disposable test identities and remove them afterward. These operational checks complement version evidence; they are not a reproduction of the CSRF vulnerability.
During the upgrade window, limit management-console access to approved administrative networks and avoid browsing untrusted content from an authenticated admin session. These are exposure-reduction measures, not substitutes for 14.61.
If recovery requires an older build, restore through the prepared vendor-supported procedure and maintain restrictions. Rolling back to 14.60 reintroduces the vulnerability; schedule the fixed update again before declaring remediation complete.
Evidence and limits
This guide uses the vendor's affected-version statement, explicit 14.61 fix mapping and administrator procedures. No proprietary Secure Access binary, CSRF reproduction, Windows installation or independent full-product test was run. Source and validation evidence records those limits.
The vendor advisory was published October 29, 2026; the CVE Program record first appeared November 2, 2026. Sources were checked November 2.