CVE-2025-27702: medium-severity vulnerability in Absolute Security Secure Access
Permissions bypass in the management console of Absolute Secure Access prior to version 13.54
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
CVE-2025-27702 is a vulnerability in the management console of Absolute
Secure Access prior to version 13.54. Attackers with administrative
access to the console and who have been assigned a certain set of
permissions can bypass those permissions to improperly modify settings.
The attack complexity is low, there are no preexisting attack
requirements; the privileges required are high, and there is no user
interaction required. There is no impact to system confidentiality or
availability, impact to system integrity is high.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Absolute Security · Secure AccessRelated CVEs — Absolute Security Secure Access
In the same product, most dangerous first.
CVE-2025-49081MEDIUMInput validation vulnerability in the Secure Access prior to version 13.55EPSS 0.5%CVE-2025-49083HIGHData deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56EPSS 0.4%CVE-2026-40957MEDIUMFrameable content vulnerability in the Secure Access server login pageEPSS 0.4%CVE-2026-55402HIGHCVE-2026-55402EPSS 0.4%CVE-2026-33445HIGHMemory management vulnerability in Secure Access serversEPSS 0.4%CVE-2026-55401MEDIUMCVE-2026-55401EPSS 0.4%