EUVD-2026-44788Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered but requires attacker tunnel control (AC:H); active client session needed (UI:R); impact limited to transient client availability disruption (A:L), no C/I impact.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
AnalysisAI
Integer underflow in the traffic parsing function of Absolute Security Secure Access clients prior to version 14.55 enables a non-persistent denial-of-service condition against the client application. Exploitation demands the attacker possess intimate knowledge of the proprietary tunnel protocol AND maintain total control over that tunnel - an exceptionally high bar that drastically limits realistic attacker population. The impact is restricted to temporarily disrupting the Secure Access client on the victim endpoint; the service recovers without persistent damage. No public exploit code exists and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Absolute Security Secure Access (CPE: cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*) is an enterprise endpoint security and connectivity client that establishes encrypted tunnels for managed device access. The vulnerability resides in the traffic parsing function responsible for decoding tunnel protocol frames. An integer underflow (analogous to CWE-191 - though the NVD entry lists CWE as N/A) occurs when a specially crafted protocol message causes an arithmetic operation to wrap below zero, producing an unexpectedly large or invalid value that disrupts normal parsing execution and crashes or stalls the client. The CVSS 4.0 vector confirms the attack arrives over the network (AV:N) but requires specific attack prerequisites to be present (AT:P), consistent with the description's requirement that the attacker command the tunnel channel itself.
RemediationAI
Upgrade Absolute Secure Access clients to version 14.55 or later, which is the vendor-confirmed fix version per the Absolute Security vulnerability advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40955. Given that exploitation requires attacker control of the tunnel protocol infrastructure, organizations should also ensure their VPN or tunnel gateway infrastructure is hardened and access-controlled, as a compromised gateway is the primary precondition for exploitation. For environments where immediate patching is not feasible, restricting which tunnel endpoints clients are permitted to connect to (via allowlist policies) would reduce exposure to a malicious tunnel controller, though this carries operational overhead in dynamic environments.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today