# CVE-2026-112110: Thales SafeNet Authentication Client race condition in log cleanup

Source: https://junglewise.ai/threats/cve-2026-112110-a-time-of-check-to-time-of-use-race-condition-in-the-safenet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-112110 · Severity: info · Published 2026-11-05

The SafeNet Authentication Client is software used to manage secure authentication and multi-factor authentication for accessing corporate systems. A race condition in its log-cleanup function allows a local user with standard privileges to manipulate file deletion operations, potentially leading to unauthorized modification or deletion of files outside the intended log directory.

Technologies: [Thales SafeNet Authentication Client](https://junglewise.ai/threats/technologies/safenet-authentication-client). Vendors: [Thales](https://junglewise.ai/threats/vendors/thales).

## Quick answers

**Is CVE-2026-112110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112110 being exploited in the wild.

**How severe is CVE-2026-112110?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Thales SafeNet Authentication Client up to and including 10.9 R3 GA (build 10.9.7449).

**Is there a fix for CVE-2026-112110?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112110 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-112110?** Check whether you run Thales SafeNet Authentication Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check to time-of-use (TOCTOU) race condition exists in the SACSrv log-cleanup function, exploitable by an authenticated, non-administrator local user. An attacker can redirect a privileged file deletion operation to targets outside the intended log directory, gaining the ability to delete arbitrary files with elevated privileges.

## Affected products

- Thales SafeNet Authentication Client up to and including 10.9 R3 GA (build 10.9.7449)

## Timeline

- 2026-11-05: disclosed

## References

- [https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249](https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249)

## Related threats

- [Thales SafeNet Authentication Client stack-based buffer overflow in SIS token engine](https://junglewise.ai/threats/cve-2026-94395-a-stack-based-buffer-overflow-in-thales-safenet-authentication)
- [Thales SafeNet Authentication Client SACSrv heap buffer overflow](https://junglewise.ai/threats/cve-2026-112109-a-local-privilege-escalation-vulnerability-in-thales-safenet)