External risk intelligence

Secure Access Server Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-116769

The vulnerability affects Secure Access servers, which are typically deployed as internet-facing gateways, VPNs, or remote access solutions. By design, these products serve as the entry point for network traffic, making them inherently public-facing and reachable in normal, standard deployment patterns.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication bypass vulnerability has been identified in Secure Access servers that could allow unauthorized modification of client security settings. This issue could potentially impact the integrity and confidentiality of data by allowing external actors to alter security configurations. The main concern is confirming relevance and exposure to affected systems.

Bypass bypasses authentication, altering security settings.
Critical for safeguarding network entry points and data.
Confirm relevance and exposure for affected servers.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication to a Secure Access server, allowing them to modify client security settings. This is possible because the vulnerability allows direct manipulation of server configurations.

No authentication is required to start.
Attackers can modify server security settings.
Leads to unauthorized client configuration changes.

Live Threat

Current exploitation, exposure, and threat context

An authentication bypass in Secure Access servers could allow an attacker to modify client security settings. This occurs when the server's authentication mechanisms are circumvented, potentially enabling unauthorized access or control over client configurations. The vulnerability affects specific versions of the Secure Access server.

Server security settings.
Unauthenticated network access.
Compromise of client configurations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The security team should identify all instances of Secure Access servers, confirm their reachability and business criticality, and then coordinate with the vendor and relevant internal teams for remediation planning. This vulnerability requires immediate attention due to its critical severity and potential for attackers to modify security settings.

Security and infrastructure teams own remediation.
Verify server reachability and business impact.
Coordinate vendor fix deployment and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Secure Access server software?

Secure Access servers are infrastructure components used to manage network connectivity and remote access for organizations. They act as central gateways, ensuring that only authorized users and devices can connect to internal resources. By controlling these connection points, the software helps maintain the boundary between external networks and private corporate data.

What does authentication bypass mean for CVE-2026-116769?

This vulnerability is an authentication bypass, which is a weakness where a system fails to properly verify who is accessing it. Because the server skips this identity check, an attacker can interact with the system as if they were a legitimate, authorized administrator. In this specific case, it allows unauthorized modification of security settings for connected clients.

How does an attacker trigger CVE-2026-116769?

An attacker triggers this flaw by sending specific, unauthorized requests directly to the Secure Access server. Because the vulnerability allows the system to be accessed without providing valid credentials, no prior user session or password is required to initiate the attack. Interactions that do not attempt to modify security settings or bypass login screens do not involve this specific exploit path.

Why is this CVE concerning for internet-facing servers?

According to Halo Surface Signal, Secure Access servers are often deployed as internet-facing gateways or VPN solutions, meaning they are designed to be reachable from the public internet. Because they serve as the entry point for network traffic, they are inherently more visible to potential attackers, increasing the risk that this authentication bypass can be reached and utilized.

What should I do if I run Secure Access servers?

First, identify all instances of the software within your infrastructure to determine which versions are in use. Check if your current version falls within the range of 13.0 up to 14.61. Once identified, prioritize these servers based on their role and business criticality, and coordinate with your technical teams to plan for vendor-provided updates.

References

www.absolute.com/platform/security-information/vulnerability-archive/c…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.