SINGAPORE, 7 AUG 2026 — A researcher found three flaws in an endpoint security product built in Singapore. The most serious of them lets an ordinary user on the machine switch off the protection the product exists to provide.
The disclosure, published by the Cyber Security Agency (CSA) on 6 August, also serves as the agency's clearest public example this year of coordinated disclosure working as intended.
What was found
CatchPulse is an endpoint security product from SecureAge, offering cloud anti-virus and application control for Windows devices. Application control is the part that matters here: it is the mechanism that decides which programs are permitted to run.
| CVE | CVSS | Effect |
|---|---|---|
| CVE-2026-55978 | 8.4 High | A non-administrative local attacker can connect to an unrestricted kernel filter communication port and bypass CatchPulse security policy enforcement |
| CVE-2026-55979 | 5.2 Medium | An improper access control check in the named pipe communication interface allows an attacker to invoke CatchPulse functions, limited to operations that enforce more restrictive policies |
| CVE-2026-55980 | 5.5 Medium | A stack buffer overrun leading to a denial-of-service condition |
As published in CSA alert AL-2026-098 of 6 August 2026. Descriptions are CSA's own wording, condensed. All three affect CatchPulse version 10.10.0 and earlier; SecureAge has released fixes for all three.
The most serious flaw requires no administrative rights or remote access. A user already on the machine, with ordinary privileges, can reach a kernel filter communication port that should not have been reachable and bypass the policy engine.
The failure mode of a security product is not the same as other software
A local privilege flaw in a word processor gives an attacker a little more leverage. A bypass in an application-control product, however, lets an attacker defeat the primary reason the product exists: to prevent unauthorised code from running.
That is the control the product was bought to provide. Organisations deploy application control precisely because they accept that malware will reach endpoints and want a layer that refuses to execute it.
The second flaw is more subtle: CSA says it allows an attacker to invoke CatchPulse functions, but only to enforce *more* restrictive security policies. Read plainly, an attacker can make the product stricter rather than looser. That sounds harmless and is not necessarily so: a security agent that can be driven to block arbitrary things by an unauthorised caller is a denial-of-service tool pointed at the business, and it is the sort of thing that gets misread as the product malfunctioning.
The timeline is the part other vendors should read
CSA publishes a disclosure timeline with this alert, which is not something every advisory carries.
| Date | Stage |
|---|---|
| 26 June 2026 | Vendor disclosure |
| 28 July 2026 | Vendor patched |
| 6 August 2026 | Public release |
The timeline as published in CSA alert AL-2026-098. RECATOOLS arithmetic on the intervals: 32 days from disclosure to patch, and a further 9 days to publication, 41 days end to end.
Thirty-two days passed from report to fix, and another nine before public disclosure. The patch, crucially, existed before the exploit details did.
The alert credits the finding to Ms Ang Kar Min, and thanks both the informer and SecureAge for coordinating through CSA's Responsible Vulnerability Disclosure Policy. A named individual researcher, a vendor that shipped fixes for all three findings, and a coordinator in between.
This disclosure does not show that CatchPulse is unusually flawed. Every security product of any complexity has this class of finding; most just never surface. It shows that the process functioned on this occasion, which is a different and more useful thing to know.
What application control is for
The severity of a bypass depends on what the product category is for.
Anti-virus asks whether a file looks malicious. Application control asks a different question: is this program on the list of things permitted to run here. The second is stricter and is the reason organisations deploy it in environments where the answer should be a short list — point-of-sale terminals, industrial controllers, finance workstations, anything where the set of legitimate software is small and stable.
The security case for it rests on the enforcement being difficult to disable. A control that a local user can switch off is just a configuration setting. Making that distinction stick is the entire value of the product.
That is why an 8.4 here reads more heavily than an 8.4 somewhere else. The flaw does not grant the attacker new privileges; it removes a restriction on privileges they already had, and the restriction was the thing being sold.
Why a national CERT running disclosure matters regionally
A researcher who finds a flaw in a commercial product first faces a practical problem: who to tell, and what to do if the vendor responds badly.
A coordinator with statutory standing changes that calculation. The researcher is not negotiating alone with a company that may prefer silence, and the vendor is not deciding unilaterally when or whether the finding becomes public.
That matters more in Southeast Asia than the individual case suggests. Regional security vendors sell into regional enterprises and governments, and a disclosure culture that works locally is the difference between findings reaching a vendor and findings reaching a market.
The counterfactual is easy to picture and hard to measure. A researcher without a route to a coordinator has three options, and two of them are worse for everyone.
The paperwork behind a disclosure
CSA's alert links two further references: SecureAge's own security-vulnerabilities page, and a write-up published by the researcher. We have not read either, and the detail in this report comes from the CSA alert alone.
This structure is the goal of the process. A successful coordinated disclosure produces three accounts of the same finding — the coordinator's summary, the vendor's advisory, and the researcher's technical write-up — published together, not in competition.
The alternative, which the industry saw for years, is a researcher publishing first because the vendor stopped replying, or a vendor publishing a vague note that never credits anyone. Both leave defenders with less than they need and researchers with less than they earned.
What to do if you run it
Update past version 10.10.0, which is the affected range CSA states. SecureAge has released fixes for all three findings and the vendor's own advisory is the place to take version detail from.
Most organisations skip the wider check. Endpoint security agents run with kernel-level access, making them among the most privileged — and least frequently patched — software in an estate. Updates are disruptive, and the agent is usually assumed to be looking after itself.
The question worth answering is simply how old the agent build is on the machines nobody reboots.
The version question nobody asks
Endpoint agents are updated on a different rhythm from operating systems, and usually a slower one.
The agent is privileged, it hooks the kernel, and an update that goes wrong can render a fleet unbootable, so change control treats it cautiously. The result is estates running an agent build that is months old while the operating systems beneath are patched weekly.
The result is an inversion: the most privileged software in the estate is often the least current.
What to watch
Two things.
The first is whether CSA keeps publishing timelines. An advisory that shows the interval between report, patch and disclosure lets an outsider judge whether a vendor is responsive, and that judgement is otherwise unavailable to buyers.
The second is whether more findings against regional security products surface through this route. One coordinated disclosure is a case; a steady flow would suggest researchers have decided the route is worth using.
View author profile → · Editorial policy
