CVE-2023-49961 is a high severity (CVSS 7.5) incorrect access control flaw in WALLIX Bastion 7.x to 10.x and Access Manager 3.x and 4.x that can expose sensitive data. WALLIX lists hotfixes in Bastion 9.0.9 and 10.0.5, and a workaround for Access Manager, so apply them.
What's affected
The record says WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x are affected. The weakness is CWE-284 (improper access control). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which means network access, no login and high confidentiality impact.
WALLIX's December 2023 alert on potential sensitive information disclosure says all supported versions of Bastion and Access Manager as an appliance are affected. It lists fixed Bastion hotfixes at 9.0.9 and 10.0.5 and lists no fixed version for Access Manager, pointing instead to a workaround article. The alert does not list fixes for other Bastion branches.
The record's version list is broader than the alert's list of fixed builds. For 7.x and 8.x, check the WALLIX alerts page and your support channel, because no fix is named for them in the alert.
How to check if you're exposed
Check the version in the Bastion or Access Manager administration interface, then compare it with the fixed hotfix levels.
This is a privileged access management product, so exposure also depends on network placement. Check who can reach the web interface and API, and whether the product is exposed to the internet. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify every WALLIX Bastion and Access Manager appliance and its version.
- Apply the Bastion 9.0.9 or 10.0.5 hotfix on those branches, following WALLIX's upgrade instructions.
- For Access Manager, follow the vendor's workaround article, and ask WALLIX for the fixed build.
- If you run Bastion 7.x or 8.x, contact WALLIX, since the alert names no fix for those branches.
- Restrict administrative interfaces to management networks, and review access logs for unusual requests.
Why it matters
Bastion and Access Manager sit in front of privileged sessions, so they hold credentials, session records and audit data. An access control flaw that leaks data from such a system is more serious than the score suggests.
The weakness class is broad: a check that should stop a caller is missing or wrong. The record gives no further detail, and I did not find reports of exploitation. This CVE is not on the CISA KEV list.
Quick check
Which versions fix it?
WALLIX lists Bastion 9.0.9 and 10.0.5 hotfixes. For Access Manager it lists a workaround and no fixed version.
Does it need a login?
No. The vector shows no privileges required.
Sources
Last reviewed: 19 October 2026.
