Secure Access CVE-2026-40953

Exploitation requires both local (physical or interactive session) access to the endpoint AND administrator-level permissions on that system. The vulnerable code path is the certificate parsing function, meaning a malformed certificate must be supplied as input to trigger the overflow. The CVSS vector PR:H confirms that standard user accounts cannot exploit this flaw. The impact is strictly limited to causing a denial of service against the Secure Access client process itself - there is no privilege escalation, no data exfiltration, and no lateral movement capability. Exploitation is further bounded by the requirement to already control the targeted machine, making this a negligible threat in environments with enforced least-privilege and no insider risk.

Real-world risk is low despite the 'heap overflow' classification. The CVSS 4.0 score of 6.7 reflects the High availability impact, but the attack prerequisites are extremely restrictive: local access plus administrator-level permissions are both required. An attacker who already possesses local admin rights has, by definition, effective control of the endpoint and gains little additional leverage by crashing the Secure Access client. EPSS data is not provided in the input, and the vulnerability is not in the CISA KEV catalog, meaning no confirmed active exploitation exists. No POC is identified. The scope is limited to the client process itself (SC:N/SI:N/SA:N), meaning the underlying OS and other systems are unaffected. This is a low operational priority for most organizations - the scenario is largely a self-inflicted DoS by a privileged insider or an attacker who has already fully compromised the endpoint.

A local administrator on a managed endpoint crafts or imports a malformed certificate and presents it to the Secure Access client's parsing function, triggering a heap overflow that causes the client process to crash and become unavailable. This could be used by a malicious insider or a post-compromise attacker already operating with admin privileges to disable endpoint security connectivity. No public exploit code has been identified at time of analysis.