EUVD-2026-44787Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:H reflects network attack with high complexity; UI:R because user must connect to attacker-controlled channel; impact is low availability loss only with no scope change.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client
AnalysisAI
Integer underflow in Absolute Security's Secure Access client prior to version 14.55 allows an attacker with full control over the tunnel protocol to cause a non-persistent denial of service against the client. The exploitation bar is extremely high - the attacker must possess both intimate knowledge of the proprietary tunnel protocol and total control over the communication channel. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor-reported CVSS 4.0 score of 2.1 reflects the negligible real-world risk.
Technical ContextAI
The vulnerability is an integer underflow in the traffic parsing function of the Absolute Security Secure Access client (CPE: cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*). Secure Access is an enterprise endpoint security and remote access client from Absolute Security (formerly Absolute Software). An integer underflow occurs when arithmetic on an unsigned integer produces a value below its minimum representable value (typically wrapping to a large positive number), which in a parsing context can cause the parser to read incorrect lengths or offsets in the data stream. No CWE was formally assigned in the available data, but the described integer underflow class is consistent with CWE-191 (Integer Underflow). The flaw resides specifically in the tunnel protocol traffic parsing path, meaning it is only reachable when processing data received over the tunnel.
RemediationAI
Patch available per vendor advisory: upgrade Absolute Secure Access clients to version 14.55 or later. The fix addresses the integer underflow in the traffic parsing function. If immediate patching is not possible, the primary compensating control is ensuring clients connect only to trusted, organization-controlled Secure Access servers - this eliminates the attacker's ability to exercise control over the tunnel protocol. Additionally, network-level controls (e.g., restricting outbound tunnel connections to known server IPs) can reduce exposure to malicious server scenarios. Given the non-persistent nature of the DoS, the operational impact of any successful exploitation is self-limiting. Full advisory: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40954.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today