Description
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.1. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-06-07
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in SecureAge CatchPulse's saappctl.sys IOCTL handler allows a local attacker to manipulate an unknown function and read sensitive data that should remain protected. The vulnerability can expose confidential information stored within the driver. It is a moderate severity issue with a CVSS score of 4.8, and it has been publicly disclosed, meaning adversaries could potentially craft custom exploits to gain access to the hidden data.

Affected Systems

The affected product is SecureAge CatchPulse, versions up through 10.9.1. The vulnerability resides in the saappctl.sys driver, accessed via the IOCTL interface. Only systems running these firmware or software versions are impacted.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Local access is required to begin the attack; an attacker must have the ability to issue IOCTL commands to the driver. Once local access is achieved, the vulnerability can be leveraged to disclose internal data exposed by the driver without additional network or privilege escalation steps.

Generated by OpenCVE AI on June 7, 2026 at 10:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SecureAge CatchPulse to a version newer than 10.9.1 that contains the fix.
  • Restrict local access to the saappctl.sys driver by configuring appropriate permissions or applying the principle of least privilege.
  • Monitor system logs for anomalous IOCTL activity that may indicate exploitation attempts, and investigate any suspicious events.

Generated by OpenCVE AI on June 7, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 07 Jun 2026 09:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.1. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title SecureAge CatchPulse IOCTL saappctl.sys information disclosure
First Time appeared Secureage
Secureage catchpulse
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:*
Vendors & Products Secureage
Secureage catchpulse
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Secureage Catchpulse
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-07T08:15:17.193Z

Reserved: 2026-06-06T16:06:09.991Z

Link: CVE-2026-11459

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-06-07T10:16:21.863

Modified: 2026-06-07T10:16:21.863

Link: CVE-2026-11459

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T10:30:05Z

Weaknesses