CVE-2023-7016 is a high severity (CVSS 7.8) improper privilege management flaw in Thales SafeNet Authentication Client for Windows before 10.8 R10. An attacker with local access can run code as SYSTEM. Update to 10.8 R10 or later from Thales. Local access is required.
What's affected
The record says SafeNet Authentication Client prior to 10.8 R10 on Windows is affected. It lists the product on Microsoft Windows. The only reference is the Thales support portal, which requires a login, so no advisory text could be read for this post and nothing beyond the record is stated here.
Get the fixed build and release notes from your Thales support account.
How to check if you're exposed
On Windows, list the installed version of SafeNet Authentication Client.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match 'SafeNet' | Select DisplayName, DisplayVersion
Check the 32-bit uninstall path as well, and review endpoint management tools that report installed software across the fleet.
What to do now
- Download SafeNet Authentication Client 10.8 R10 or later from the Thales support portal.
- Roll the update through your endpoint management tool and confirm versions afterward.
- Limit local logins on shared or kiosk machines that use smart cards or tokens.
- Keep a list of machines that run token middleware, since it installs drivers and services with high privilege.
Why it matters
The record says the flaw allows an attacker to execute code at SYSTEM level through local access, and tags CWE-269, improper privilege management. Token and smart card middleware installs services and drivers that run with high privilege, so weaknesses in them are usually paths from a normal user to SYSTEM.
Local privilege escalation flaws matter most on shared or multi-user systems, and on machines where a low-privilege account already exists for a service. The attacker needs a foothold first, but a foothold plus a root-level flaw is how small incidents become full compromises.
Desktop and agent software is easy to miss because it sits outside the usual server patch cycle. Build a list of where it runs, push the update through your software deployment tool, and confirm the installed version afterward rather than trusting the job status.
Weakness class in the record: CWE-269 (Improper Privilege Management).
Quick check
Why do we only have the record to go on?
The vendor advisory sits behind a support login. When that happens, use the vendor portal for the fix and release notes, and treat third-party summaries with care.
How do I confirm the fix landed?
Check the version on a sample of hosts after rollout and keep the output as evidence. Deployment tools can report success while some hosts miss the update.
Sources
The vendor portal requires a login, so details come from the NVD record.
Last reviewed: 19 October 2026.
