CVE-2026-40952: Privilge misconfiguration in Secure Access installers
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Secure Access (Windows client and server)to a version that resolves this vulnerability.Fixed in 14.55 - Compensating control
Ensure Secure Access is installed in the default location (the issue affects the Secure Access installer for the Windows client and server prior to version 14.55 when installed in a non-default location).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40952?
CVE-2026-40952 has a risk score of 44, indicating it poses significant security concerns.
How do I fix CVE-2026-40952?
To fix CVE-2026-40952, update the Secure Access installer to version 14.55 or later.
What type of vulnerability is CVE-2026-40952?
CVE-2026-40952 is classified as a privilege misconfiguration vulnerability.
Who is affected by CVE-2026-40952?
CVE-2026-40952 affects users of the Secure Access installer for both Windows client and server prior to version 14.55.
What can attackers do with CVE-2026-40952?
Attackers with local access can exploit CVE-2026-40952 to elevate their privileges to Administrator on affected systems.