High severity · published Apr 30, 2026
CVE-2026-33451
Arbitrary read/write vulnerability in Windows clients prior to 14.50
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure
Access Windows client prior to 14.50. Attackers with local control of
the Windows client can send malformed data to an API and elevate their
level of privilege to system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access · Absolute Software
before 14.50 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33451
Vendor Advisory
https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33451
More from Secure Access
9.8
CVE-2026-33447
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50
9.8
CVE-2026-33446
Buffer overflow in client authentication prior to version 14.50
7.5
CVE-2026-33449
Message handler buffer overflow in clients prior to 14.50
6.5
CVE-2026-40950
Buffer overflow in the Secure Access server prior to 14.50
5.9
CVE-2024-40875
Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52