The vulnerability is a cross‑site scripting flaw in the Secure Access console that exists in all releases prior to version 14.20. An attacker who has administrative privileges can inject malicious script payloads into the console, potentially causing the console to execute the attacker’s code in the context of another administrator. Because the code runs with the privileges of the victim administrator, the attacker could manipulate the administrator’s session, exfiltrate sensitive information, or redirect the user to a malicious site, thereby compromising the integrity and availability of the console for legitimate administrators.

Absolute Security’s Secure Access product is affected for all releases earlier than 14.20. No specific patch versions are listed; consequently any installation that runs a version older than 14.20 is vulnerable.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS probability of less than 1 % signifies that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires administrative credentials to the console, making the threat vector an internal or compromised‑account scenario rather than a remote attacker able to drop arbitrary scripts from an unauthenticated connection.