# CVE-2026-97718: Absolute Secure Access cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-97718-is-a-cross-site-request-forgery-vulnerability-in-version-14-60-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-97718 · Severity: info · Published 2026-11-02

Absolute Secure Access is a privileged access management solution used to control administrative access to critical systems. A cross-site request forgery (CSRF) vulnerability in version 14.60 allows an attacker to trick an authenticated administrator into creating new user accounts under the attacker's control, potentially granting unauthorized administrative access.

Technologies: [Absolute Secure Access](https://junglewise.ai/threats/technologies/absolute-secure-access). Vendors: [Absolute](https://junglewise.ai/threats/vendors/absolute).

## Quick answers

**Is CVE-2026-97718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97718 being exploited in the wild.

**How severe is CVE-2026-97718?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Absolute Secure Access 14.60.

**Is there a fix for CVE-2026-97718?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97718 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-97718?** Check whether you run Absolute Secure Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSRF vulnerability exists in Absolute Secure Access 14.60 where a bypassed security control allows state-changing operations (account creation) to be performed without proper anti-CSRF token validation. An attacker can craft a malicious webpage that, when visited by an authenticated admin, triggers account creation requests executed in the admin's authenticated session. Exploitation requires the victim to visit attacker-controlled content while authenticated to the Secure Access server.

## Affected products

- Absolute Secure Access 14.60

## Timeline

- 2026-11-02: disclosed

## References

- [https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718](https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718)

## Related threats

- [Absolute Secure Access missing length validation](https://junglewise.ai/threats/cve-2026-116768-is-a-missing-length-validation-vulnerability-in-secure-access)
- [Absolute Secure Access improper input handling denial of service](https://junglewise.ai/threats/cve-2026-116767-is-an-improper-input-handling-vulnerability-in-secure-access)
- [Absolute Secure Access improper input handling denial of service](https://junglewise.ai/threats/cve-2026-116766-is-an-improper-input-handling-vulnerability-in-the-secure-access)
- [Absolute Secure Access authentication bypass](https://junglewise.ai/threats/cve-2026-116769-is-an-authentication-bypass-vulnerability-in-secure-access)
- [is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the W](https://junglewise.ai/threats/cve-2026-40951-is-a-memory-corruption-vulnerability-on-secure-access-windows)