Absolute Secure Access CVE-2026-116767

Requires a valid authenticated session to the Absolute Secure Access server (CVSS PR:L) - exploitation is not available to unauthenticated attackers. Given that precondition, the flaw is reachable remotely over the network (AV:N), at low complexity (AC:L), with no user interaction (UI:N), and no special attack requirements (AT:N). The specific product feature, protocol endpoint, or configuration that must be reached to deliver the malformed input is not described in the available sources. The principal limiting factor is the authentication requirement; the principal aggravating factor is that the resulting denial of service is persistent (VA:H) rather than transient. Fixed in version 14.61 - all prior versions are affected; the vendor advisory presents upgrading as the remediation.

This is a medium-to-high severity, authenticated denial-of-service issue in Absolute Secure Access servers (CVSS 4.0 base 7.1). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L) indicates remote, low-complexity exploitation with no user interaction but requiring low-level privileges (PR:L) - so an attacker must already be authenticated. Impact is concentrated on availability (VA:H, persistent DoS) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N). No EPSS score was provided, the CVE is not listed in CISA KEV, and no exploit or PoC reference is present in the input - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', which signals meaningful but non-emergency urgency rather than act_now/emergency. Net: this is a genuine availability risk worth remediating on a near-term schedule, but the authentication requirement and the availability-only (non-RCE, non-data-exposure) impact place it below the tier of critical unauthenticated flaws. Note that CVSS asserts a network vector while the description does not describe the exact trigger mechanism - the precise input/feature that must be reached is not stated in the available sources.

An attacker who already holds valid (low-privilege) credentials to an Absolute Secure Access server sends crafted or malformed input that the server handles improperly, driving it into a persistent denial-of-service state that survives beyond the request and disrupts service for all users. The CVSS AV:N/AC:L profile means this can be done remotely over the network with low effort once authenticated. No public exploit code was identified at time of analysis.