Absolute Secure Access CVE-2026-40954

Exploitation requires all of the following simultaneously: (1) the attacker must have total control over the tunnel protocol channel - either by operating a server the client connects to, or by holding a man-in-the-middle position; (2) the attacker must have intimate knowledge of the Absolute Secure Access proprietary tunnel protocol internals to construct a triggering payload; (3) active user interaction is required (UI:A in CVSS 4.0), meaning the user must initiate or maintain a connection; and (4) a specific attack precondition (AT:P) must be met. The impact is strictly non-persistent availability loss affecting only the client - no data is disclosed, no integrity is affected, and the condition resolves once the attack ends. These compounding prerequisites make opportunistic or automated exploitation effectively infeasible.

Real-world risk is minimal. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores 2.1, correctly reflecting all limiting factors: high attack complexity, a specific attack requirement (AT:P - intimate protocol knowledge), active user interaction required, and only low availability impact with no confidentiality or integrity impact. The description's explicit prerequisite - 'intimate knowledge of and total control over the tunnel protocol' - places this firmly in the category of targeted, high-effort attacks with minimal payoff: a non-persistent DoS that ends when the attack ceases. There is no KEV listing and no public exploit identified. The Information Disclosure tag present in the source metadata is inconsistent with the vulnerability description, which describes only a DoS outcome; this discrepancy is unexplained and may reflect a metadata error. SSVC signals would categorize this as low priority: exploitation is not demonstrated publicly, impact is limited to a single client's availability, and the attack is not automatable at scale.

An attacker operating a malicious Secure Access server, or holding a man-in-the-middle position on the network path, crafts tunnel protocol traffic specifically engineered to trigger the integer underflow in the client's parsing function. The client crashes or becomes unresponsive for the duration of the attack, losing its tunnel connection. Once the malicious traffic stream ends or the user reconnects, the DoS condition resolves without persistent damage.