CVE-2025-54089
MEDIUM EPSS 9.0%
Published Oct 2, 20258mo ago · Modified Jun 17, 20261w ago
4.6 CVSS 4.0
Published Oct 2, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago
Description
CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges required to execute the attack are high and the victim must actively participate in the attack sequence. There is no impact to confidentiality or availability, there is a low impact to integrity.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction A
Scope X
Threat Intelligence
EPSS Exploit Probability
9.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| absolute | secure_access | * | <14.10 |
References 1
- absolute.com https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54089
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.