CVE-2023-5993 is a high severity (CVSS 7.8) local privilege escalation in the Windows Installer used by Thales SafeNet Authentication Client. Versions before 10.8 R10 are affected. A local attacker can raise their privileges. Update to 10.8 R10 or later, using the customer notice on the Thales support portal.
What's affected
- Product: Thales SafeNet Authentication Client for Windows.
- Affected: versions prior to 10.8 R10.
- Fixed: 10.8 R10, per the NVD record.
- Severity: 7.8 High in the NVD record (local attack).
- Source limit: the Thales support portal needs a login, so the vendor notice could not be read during this review. The details here come from the NVD record only.
How to check if you're exposed
On a Windows machine, open Settings, then Apps, and read the version of SafeNet Authentication Client. Or use PowerShell to list the installed version across machines you manage:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -like "*SafeNet Authentication Client*" } |
Select-Object DisplayName, DisplayVersion
Compare the result with 10.8 R10. Because token clients are usually deployed by software distribution tools, your endpoint management system probably has the same data for the whole fleet.
What to do now
- Update SafeNet Authentication Client to 10.8 R10 or later, using the package from the Thales support portal.
- Roll the update out through your software distribution tool, and verify the installed version afterward.
- Where you cannot update soon, limit who has local logon rights on machines that carry the client, such as shared workstations and terminal servers.
- Read the Thales customer notice after logging in for any extra guidance not in the public record.
- Record which machines carry the client, so the next advisory can be matched quickly.
Why it matters
The record describes the flaw as an issue in how the Windows Installer works for this product, with the result that a local attacker raises their privilege level. The weakness class is CWE-269, improper privilege management. Installer related escalations usually come from a step that runs with high privileges but touches something a normal user can influence.
The record gives no further detail, and the vendor notice is behind a login, so this post stops there. Local privilege escalation bugs matter most on shared machines and as a second step after an attacker gets a normal user foothold, for example through phishing. They are not remotely exploitable by themselves. The record does not list this CVE as known exploited.
Quick check
Why so little detail?
The only public record is short, and the vendor advisory sits behind a customer login. This post does not guess at the mechanism.
Sources
Last reviewed: 19 October 2026.
