CVE-2025-49084 is a critical flaw (CVSS 9.1) in the management console of Absolute Secure Access before version 13.56. An attacker who already has administrative access can overwrite policy rules without the permissions that should be required. Upgrade to 13.56 or later.
What's affected
The CVE record and the vendor's security page agree that Absolute Secure Access prior to version 13.56 is affected, and the vendor page was last updated on 30 July 2025. The weakness sits in the management console, not in the client software on endpoints.
The vendor describes the attack as low complexity, with attack requirements present, high privileges required and no user interaction. The impact on the vulnerable system itself is limited to low integrity. The impact on connected systems is rated high for confidentiality and availability. That split is why the NVD score of 9.1 looks high for a flaw that needs an administrator.
How to check if you're exposed
Find the version of the management console in your deployment. The version is shown in the console and in the product's release information. Compare it to 13.56. If you use a hosted service run by the vendor, check with the vendor which build your tenant runs, since the version may be managed for you.
Next, review who holds administrative roles. The flaw requires high privileges, so the number of accounts with that access sets the size of the risk. Also check whether the console is reachable from outside your management network.
Finally, review the policy change history for edits you did not make or approve. A policy rule controls what traffic a secure access product allows, so unexpected changes are worth a ticket even when there is no other sign of trouble.
What to do now
- Confirm the Absolute Secure Access version in every environment.
- Upgrade to 13.56 or later by following the vendor's instructions.
- Reduce the number of administrator accounts, and require strong authentication for the ones that remain.
- Restrict console access to a management network.
- Review the policy change history and compare current rules to a known good baseline.
Why it matters
The record files this under CWE-276, incorrect default permissions. In practical terms, an action that should be limited to a narrower role can be done by an administrator who lacks that permission. Administrative access is meant to be bounded by finer permissions, and when that boundary fails, one compromised or malicious admin account gains more power than the design intended.
Policy rules in a secure access product decide who may reach which resource. Changing them quietly can open a path that was meant to stay closed, which is why the vendor rates the effect on subsequent systems as high. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the vendor page does not report exploitation.
Quick check
Does an attacker need an account?
Yes. The record says high privileges are required, meaning administrative access. The risk is about an admin overstepping or a stolen admin account.
Which version fixes it?
Version 13.56 per the record and vendor page. Check the vendor page for later guidance.
Sources
Last reviewed: 18 October 2026.
