Absolute Secure Access CVE-2026-116766

Exploitation requires network reachability to the Absolute Secure Access server and a low-privilege authenticated foothold (CVSS PR:L), targeting versions from 13.0 up to but not including 14.61. The flaw is improper handling of attacker-supplied input that causes a persistent (not transient) denial of service; the specific input, protocol, feature, or configuration that triggers it is not described in the available sources. Limiting factors: the PR:L requirement means a purely anonymous external attacker cannot trigger it without first obtaining some authenticated access, and no user interaction is required (UI:N). Versions at or above 14.61 are not affected.

This is a moderate-priority availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H, score 8.3) describes a network-reachable, low-complexity flaw requiring low-level privileges (PR:L), with impact confined entirely to availability - no confidentiality or integrity loss - but affecting both the vulnerable system (VA:H) and a subsequent system (SA:H), consistent with a persistent denial of service of the Secure Access server. The vuln.today decision label is 'this_week', which signals meaningful but not immediate (act_now/emergency) urgency. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference were provided, so there is no evidence of active exploitation or available exploit code. The headline severity is driven almost entirely by the persistent availability impact on a network-facing security appliance; because PR:L means an attacker must already hold some authenticated foothold, real-world risk is lower than a PR:N DoS would be. Key missing signals to flag explicitly: EPSS probability is absent (cannot gauge likelihood of exploitation), KEV status is not present, and the single reference is a vendor advisory landing page rather than technical detail - the exact trigger mechanism for the improper input handling is not described in the available sources.

An attacker who holds low-level authenticated access to a network-reachable Absolute Secure Access server (versions 13.0 up to but not including 14.61) sends crafted, improperly-handled input to the server. The malformed input triggers a condition that persistently denies service, keeping the secure-access gateway down until manual remediation. No public exploit code was identified at time of analysis.