Absolute Secure Access CVE-2026-33448

Upgrade Absolute Secure Access to version 14.50 or later. Vendor has released a patch addressing the format string flaw in the logging subsystem. Administrators should deploy the patched version across all macOS endpoints running Secure Access. If immediate upgrade is not feasible, restrict local user access to systems running vulnerable Secure Access versions, particularly in environments where untrusted local users may gain shell access. Additionally, monitor log files from affected Secure Access installations for suspicious format string patterns (e.g., repeated %x or %n specifiers) that may indicate exploitation attempts. Network segmentation to limit which servers Secure Access clients can communicate with reduces the attack surface, as the attacker must first control a modified server the client trusts. Refer to the vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33448 for specific patching timelines and supported versions.