CVE-2025-54089: medium-severity vulnerability in Absolute Security Secure Access
Cross-site Scripting vulnerability in Secure Access prior to 14.10
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.6epss 0.2%
CVE-2025-54089 is a cross-site scripting vulnerability in versions
of secure access prior to 14.10. Attackers with administrative access to the
console can interfere with another administrator’s access to the console. The
attack complexity is low; there are no attack requirements. Privileges required
to execute the attack are high and the victim must actively participate in the
attack sequence. There is no impact to confidentiality or availability, there
is a low impact to integrity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Absolute Security · Secure AccessRelated CVEs — Absolute Security Secure Access
In the same product, most dangerous first.
CVE-2025-49081MEDIUMInput validation vulnerability in the Secure Access prior to version 13.55EPSS 0.5%CVE-2025-49083HIGHData deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56EPSS 0.4%CVE-2026-40957MEDIUMFrameable content vulnerability in the Secure Access server login pageEPSS 0.4%CVE-2026-55402HIGHCVE-2026-55402EPSS 0.4%CVE-2026-33445HIGHMemory management vulnerability in Secure Access serversEPSS 0.4%CVE-2026-55401MEDIUMCVE-2026-55401EPSS 0.4%