CVE-2026-112110

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112110", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-10-18T20:48:23.912Z", "datePublished": "2026-11-05T17:33:45.540Z", "dateUpdated": "2026-11-05T20:10:51.548Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T17:33:45.540Z"}, "title": "Privileged file deletion in SafeNet Authentication Client SACSrv", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-59", "description": "CWE-59 Improper link resolution before file access ('link following')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client Service", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "10.9.7449", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "10.9.7449"}]}]}], "descriptions": [{"lang": "en", "value": "A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can\u00a0allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log\ndirectory.\u00a0\n\n\n\nThis issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can&nbsp;allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log<br>directory.&nbsp;</p><p>This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).</p>"}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.8, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later."}]}], "credits": [{"lang": "en", "value": "David Carliez (david.carliez.consulting@gmail.com)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:10:34.597050Z", "id": "CVE-2026-112110", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:10:51.548Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-112110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:10:34.597050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:10:28.513Z"}}], "cna": {"title": "Privileged file deletion in SafeNet Authentication Client SACSrv", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Carliez (david.carliez.consulting@gmail.com)"}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client Service", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "10.9.7449"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "base64": false}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can\u00a0allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log\ndirectory.\u00a0\n\n\n\nThis issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "value": "<p>A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can&nbsp;allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log<br>directory.&nbsp;</p><p>This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper link resolution before file access ('link following')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "10.9.7449", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T17:33:45.540Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112110", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:10:51.548Z", "dateReserved": "2026-10-18T20:48:23.912Z", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "datePublished": "2026-11-05T17:33:45.540Z", "assignerShortName": "THA-PSIRT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Safenet Authentication Client Service", "vendor": "Thalesgroup", "versions": [{"lessThanOrEqual": "10.9.7449", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@thalesgroup.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can\u00a0allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log\ndirectory.\u00a0\n\n\n\nThis issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449)."}], "id": "CVE-2026-112110", "lastModified": "2026-11-06T21:33:01.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@thalesgroup.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112110", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:10:34.597050Z", "version": "2.0.3"}}]}, "published": "2026-11-05T18:17:00.967", "references": [{"source": "psirt@thalesgroup.com", "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249"}], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}], "source": "psirt@thalesgroup.com", "type": "Secondary"}]}

{"bugzilla": {"description": "SafeNet Authentication Client: SafeNet Authentication Client: Arbitrary file deletion via race condition in SACSrv log cleanup", "id": "2567642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567642"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in SafeNet Authentication Client (SAC). This vulnerability allows an authenticated local user to delete arbitrary files with elevated privileges by exploiting a time-of-check to time-of-use (TOCTOU) race condition in the SACSrv log-cleanup routine. By redirecting privileged file deletion operations outside the intended log directory, an attacker could compromise system integrity or cause a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-112110", "public_date": "2026-11-05T17:33:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112110\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112110\nhttps://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=ab05ca862b505350cdc1f87df291bfce&sysparm_article=KB0031249"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires pre-existing local system access and winning a tight timing window, while only permitting arbitrary file removal rather than direct arbitrary code execution or credential disclosure. SafeNet Authentication Client is proprietary third-party software provided by Thales and is not packaged or distributed across Red Hat supported products. Consequently, default installations of Red Hat Enterprise Linux and other Red Hat platforms are not impacted unless this standalone third-party security software has been manually introduced into the environment.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.9.7449]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 92.0, "source": "matching"}]}, "original": {"product": "Safenet Authentication Client Service", "source": "cna", "vendor": "Thalesgroup"}, "product": "safenet_authentication_service", "vendor": "thalesgroup"}], "created": "2026-11-05T19:15:07.010975+00:00", "updated": "2026-11-06T16:30:07.053096+00:00", "vendors": ["thalesgroup", "thalesgroup$PRODUCT$safenet_authentication_service"]}