Critical severityNVD Advisory· Published Sep 9, 2026

CVE-2026-68484

Description

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.

Affected products

Sage/AR Automation APIllm-create

Patches

Vulnerability mechanics

References

helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026nvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000