CVE-2026-55978: SecureAge CatchPulse Access Control Flaw
TL;DR - CVE-2026-55978 is a high-severity local improper access control flaw in SecureAge CatchPulse. - A non-admin local user may connect to an unrestricted kernel filter communication port and bypass policy enforcement. - Fixes are reported available, but exact affected and fixed versions were not publicly extractable from the referenced source text.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-55978 |
| CVSS score | 8.4 |
| Attack vector | Local |
| Auth required | Yes, local non-administrative access |
| Patch available | Yes, according to CSA advisory metadata |
CVE-2026-55978 affects SecureAge CatchPulse, an endpoint security product. The issue is notable because it weakens a defensive control rather than directly targeting a business application. In practice, that means a user who already has local access to a system may be able to interfere with enforcement performed by the product’s kernel-connected components.
The most important operational takeaway is that this is not described as a remote unauthenticated bug. It requires local access, but that should not reduce urgency too much for enterprise defenders. Local control bypasses are often useful in real intrusions after phishing, initial malware execution, or abuse of legitimate user accounts. Because CatchPulse is a security product, successful exploitation can create room for follow-on activity that would otherwise be blocked.
What Is This Vulnerability?
According to the NVD description, the root cause is improper access control in CatchPulse. Specifically, a non-administrative local attacker can connect to an unrestricted kernel filter communication port and bypass CatchPulse security policy enforcement. That description points to a trust-boundary failure between low-privileged user space and a privileged product component.
In endpoint security products, kernel filter communication channels typically exist so services, agents, or management components can send instructions to drivers or receive enforcement telemetry. Those channels must be tightly restricted. If a communication port is exposed too broadly, lower-privileged users may be able to issue requests, alter behavior, suppress controls, or otherwise influence the product’s decision-making. That appears to be the security model failure here.
For defenders, the practical concern is not just “can a user talk to a port,” but “what does that let the user disable, evade, or downgrade?” The published description says policy enforcement can be bypassed, which suggests attackers may be able to neutralize or circumvent protective controls on the endpoint without first obtaining administrative rights. Even when a flaw is local-only, that can materially reduce the effectiveness of application control, malware blocking, or policy-based restrictions.
Technical Notes
The available public description does not include protocol details, IOCTL identifiers, named port names, or sample exploit traffic. Defenders should therefore avoid assuming a network-facing service or TCP/UDP exposure. The phrase “kernel filter communication port” more likely refers to an internal OS-mediated communication mechanism between user mode and kernel mode on the host.
In the absence of vendor-published technical specifics, the safest working assumption is that any unexpected user-mode interaction with CatchPulse driver-facing or service-facing interfaces by non-admin accounts is suspicious until proven otherwise.
Who Is Affected?
The confirmed affected product is SecureAge CatchPulse. Product identification is supported by the NVD record and by SecureAge product documentation that references CatchPulse components including drivers and services relevant to endpoint policy enforcement.
What remains unclear from the currently available source text is the exact affected version range. The CSA advisory snippet confirms multiple CatchPulse vulnerabilities and states that SecureAge rolled out fixes for all reported vulnerabilities, but the captured advisory content does not expose a machine-readable affected-version table. Likewise, the referenced SecureAge security vulnerabilities page was present but did not yield an extractable version matrix in the available text.
Defenders should therefore be careful not to overstate scope. At the time of writing, it is accurate to say that CatchPulse is affected, but inaccurate to claim a verified vulnerable range such as “before X.Y.Z” unless you have obtained the vendor advisory directly and confirmed it. If you operate CatchPulse in production and cannot immediately verify the build level against the vendor bulletin, assume your installed version may be affected until SecureAge support or an authenticated advisory confirms otherwise.
The same caution applies to the fixed version number. A fix exists based on the CSA statement that SecureAge rolled out fixes for all reported vulnerabilities. However, the specific fixed build number was not extractable from the provided references. Administrators should retrieve the current vendor advisory or open a support case to confirm the exact remediated release before change planning.
Technical Notes
A practical asset inventory starting point on Windows endpoints would be to identify installed CatchPulse software and related services:
Get-Service | Where-Object { $_.DisplayName -match "CatchPulse|SecureAge" -or $_.Name -match "CatchPulse|SecureAge" }
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -match "CatchPulse|SecureAge" } |
Select-Object DisplayName, DisplayVersion, Publisher
If these queries return installed CatchPulse components but you cannot map the displayed version to a vendor-fixed release, treat the endpoint as potentially vulnerable until verified.
CVSS Score Breakdown
The published base score is 8.4, which puts this vulnerability in the high-severity range. Even without the full vector string exposed in the returned NVD output, several score drivers are apparent from the description: the issue is locally exploitable, does not require administrative privileges, and affects the integrity of endpoint policy enforcement in a meaningful way.
A local attack vector lowers exposure compared with remote code execution, but the score remains high because the flaw appears to let a lower-privileged user bypass a security boundary enforced by a security product. In enterprise environments, local authenticated access is often easy for attackers to obtain through stolen credentials, initial malware execution, or abuse of remote access tools. That makes local control-bypass flaws operationally relevant, especially on shared systems, VDI environments, jump hosts, and developer workstations.
The “privileges required” component is likely favorable to attackers because the NVD description explicitly says a non-administrative local attacker can exploit it. That means the vulnerability does not depend on prior admin rights. The likely impact is strongest on integrity, since security policy enforcement may be bypassed. Availability impact is not described for this specific CVE, and confidentiality impact is also not directly stated in the public description.
Because the full vector string was not exposed in the source material, defenders should avoid claiming exact metric values for attack complexity, user interaction, scope, or CIA impacts. The prudent operational interpretation is simply that the score is high enough to justify expedited review and patching, especially anywhere CatchPulse is a core control in the endpoint hardening stack.
Exploitation Status
At the time of writing, exploitation in the wild is not confirmed from the provided primary sources. CVE-2026-55978 is not listed in CISA’s Known Exploited Vulnerabilities catalog. That means there is no KEV-based confirmation of active exploitation by CISA as of 2026-08-06.
No verified public proof-of-concept was identified in the gathered material either. The available search context did not surface a clearly relevant GitHub repository or technical write-up containing exploit steps for this CVE. That does not prove no PoC exists; it only means none was confirmed from the referenced sources.
For defenders, the right stance is measured caution. Lack of KEV listing and absence of a known public PoC should not be interpreted as low risk. Local bypasses in security products can become attractive to adversaries after initial access because they help neutralize defenses and make persistence or payload execution easier. If you operate CatchPulse broadly, especially on systems where users have local logon capability, prioritize validation and remediation rather than waiting for public exploitation news.
A second practical point is that exploitation may be difficult to observe if it occurs through a local inter-process or kernel communication mechanism that is not logged by default. That increases the importance of version verification, host hardening, and monitoring for side effects such as sudden policy non-enforcement or unusual service interactions.
How to Detect It
Detection is challenging because the public advisory data does not provide a named IPC endpoint, exact service API, or specific event IDs tied to exploitation. As a result, there is no authoritative detection signature available from the sources cited. Defenders should focus on behavior-based monitoring around CatchPulse components, unexpected interaction by low-privileged processes, and signs that policy enforcement is no longer functioning as expected.
Start by baselining normal CatchPulse service and driver behavior on healthy endpoints. Then investigate deviations such as repeated service restarts, unexpected handles opened by untrusted user processes to security product components, or mismatches between configured policies and actual enforcement outcomes. If your EDR can monitor device object access, named pipes, ALPC endpoints, or privileged service interactions, look for user-context processes interacting with SecureAge-related components unexpectedly.
Technical Notes
The following examples are heuristic and should be treated as hunting leads, not vendor-confirmed signatures.
PowerShell: enumerate SecureAge and CatchPulse-related processes and services
Get-Process | Where-Object { $_.ProcessName -match "CatchPulse|SecureAge" } |
Select-Object ProcessName, Id, Path
Get-Service | Where-Object { $_.DisplayName -match "CatchPulse|SecureAge" -or $_.Name -match "CatchPulse|SecureAge" } |
Select-Object Name, DisplayName, Status, StartType
Windows event hunting idea: look for suspicious child processes or service control activity involving CatchPulse components
Get-WinEvent -LogName Security -MaxEvents 500 |
Where-Object { $_.Message -match "CatchPulse|SecureAge" }
Sysmon/SIEM hunting pattern
Search for:
- Process access or handle-open events where a non-admin user process targets SecureAge/CatchPulse services
- Service state changes for CatchPulse-related services outside maintenance windows
- Endpoint policy mismatch events, if CatchPulse exports them, immediately followed by user-session activity
Example Sigma-style logic sketch
title: Suspicious Non-Admin Interaction With SecureAge CatchPulse Components
logsource:
product: windows
detection:
selection_proc:
Image|contains:
- '\AppData\'
- '\Users\Public\'
selection_target:
TargetImage|contains:
- 'CatchPulse'
- 'SecureAge'
condition: selection_proc and selection_target
level: medium
Because there is no published authoritative log pattern for CVE-2026-55978 yet, defenders should combine these hunts with validation testing in a controlled environment once the vendor provides more technical detail.
Mitigation and Patching
The clearest remediation fact available is that fixes have been rolled out by SecureAge, according to the CSA advisory metadata. If you run CatchPulse, patching should be your primary mitigation. However, the specific fixed version number was not extractable from the provided source text, so administrators need to confirm the remediated release directly from SecureAge’s advisory portal or support channels before change execution.
If immediate patching is not possible, focus on reducing opportunities for local exploitation. Restrict local logon where feasible, minimize use of shared user workstations, enforce least privilege, remove unnecessary local accounts, and monitor for attempts to tamper with endpoint security services. Since this is a local non-admin issue, reducing who can execute arbitrary code or log on interactively to affected systems materially lowers exploitability.
You should also review any local self-protection, tamper protection, or service-hardening options available in CatchPulse and related SecureAge components. While there is no source-confirmed workaround specific to this CVE, products in this category may provide additional hardening settings that make user-mode interaction with sensitive components more difficult. Validate those settings with the vendor before relying on them as compensating controls.
Because exact vulnerable and fixed versions are not confirmed in the available references, do not state internally that “upgrade to version X” unless you have retrieved that exact value from the vendor. The correct operational message is: upgrade to the latest SecureAge-fixed CatchPulse release that addresses CVE-2026-55978, as confirmed by the vendor advisory.
Technical Notes
Inventory installed version before remediation
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -match "CatchPulse|SecureAge" } |
Select-Object DisplayName, DisplayVersion, InstallDate
If CatchPulse is deployed through enterprise software management, redeploy the vendor-provided fixed installer package.
Because the exact package name and version were not available from the source material, use your authenticated SecureAge download portal or internal software repository to obtain the fixed release.
Example enterprise upgrade workflow
# Example only: replace with the actual vendor-provided installer and arguments
msiexec /i "SecureAge-CatchPulse-FixedVersion.msi" /qn /norestart
Temporary containment steps
# Restrict interactive logon through policy rather than disabling security software.
# Avoid stopping CatchPulse services as a workaround unless explicitly directed by the vendor.
Do not disable CatchPulse as a workaround unless SecureAge explicitly recommends doing so. Disabling a security product to avoid a local bypass can leave the endpoint worse off than before.
References
The primary public source for the vulnerability description is the NVD entry for CVE-2026-55978. It states that improper access control in CatchPulse allows a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass security policy enforcement. This is the key technical description used for impact assessment.
The Cyber Security Agency of Singapore advisory is the strongest publicly referenced source confirming that multiple CatchPulse vulnerabilities were identified and that SecureAge rolled out fixes for all reported issues. However, in the available captured text, it does not expose an exact affected-version or fixed-version table for this CVE. The SecureAge security vulnerabilities page is the likely authoritative source for exact builds, but those details were not extractable from the source snippet provided.
For more information on related vulnerabilities, you can check the following articles: What is Typosquatting? and What is Kubernetes Secret Rotation?.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.