CVE-2026-97718
CriticalCVSS 9.4Summary
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
Risk Assessment
An attacker could gain persistent access to the system through an account created with administrative privileges, potentially leading to full control over the Secure Access server.
Recommendation
Update Secure Access server to a version later than 14.60 that includes the fix. Additionally, implement CSRF protections such as anti-CSRF tokens and Origin header validation.
Other vulnerabilities in Secure Access server
See all- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
- CVE-2026-40957High
CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
Original NVD description (English source)
CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS