Absolute Secure Access CVE-2026-40955

Exploitation requires two simultaneous conditions: (1) the attacker must possess intimate knowledge of the Absolute Secure Access tunnel protocol internals - not publicly documented - and (2) the attacker must have total control over the tunnel channel through which the victim client communicates, such as by operating a malicious or compromised tunnel endpoint. Active user interaction is also required (CVSS UI:A), meaning a client must be actively connected through the attacker-controlled tunnel at time of attack. These conditions together make opportunistic exploitation essentially infeasible; the realistic attacker is a malicious infrastructure operator or insider with access to the tunneling environment. The DoS is non-persistent, meaning the client recovers without manual intervention. Exploitation does not yield confidentiality or integrity impact - it is limited to temporarily disrupting client availability.

The real-world risk of this vulnerability is very low. The CVSS 4.0 base score of 2.1 accurately reflects the constrained threat model: AV:N indicates the vector is network-delivered, but AC:H and AT:P together confirm that high attack complexity and prerequisite conditions - specifically, attacker control over the tunnel protocol - must both be satisfied. The impact is limited to a transient, non-persistent client-side availability disruption (VA:L), with zero confidentiality or integrity consequence (VC:N/VI:N). No EPSS data was provided, no KEV listing exists, and no public exploit code has been identified. The 'Information Disclosure' tag in the source data conflicts with the CVE description, which describes only a DoS; this discrepancy should be treated as a likely metadata error and does not elevate risk. The primary threat scenario is a malicious or compromised VPN/tunnel gateway targeting its own connected clients, which is an insider or infrastructure-compromise scenario rather than an opportunistic internet attack.

An attacker who has compromised or controls a VPN/tunnel gateway that Absolute Secure Access clients connect to crafts malformed tunnel protocol messages exploiting intimate knowledge of the protocol structure to induce an integer underflow in the client's traffic parser. The targeted client application crashes or becomes temporarily unresponsive, disrupting the user's secure access session until the client recovers or is restarted. No public exploit code exists for this scenario.