EUVD-2026-44790Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires MitM protocol control (AC:H) and active session (UI:R); only minor memory disclosure with no integrity or availability impact.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.
AnalysisAI
Memory disclosure in Absolute Security Secure Access client (versions prior to 14.55) permits a small, indeterminate amount of process memory to leak to an adversary who has already achieved full control over the tunnel protocol. The CVSS 4.0 score of 2.1 accurately reflects the narrow real-world impact: an attacker must simultaneously possess intimate protocol knowledge and the ability to manipulate tunnel communications end-to-end, a prerequisite that dramatically limits the exploitable population. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog, reinforcing its low operational priority for most enterprises.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:* - Absolute Security's enterprise VPN and remote-access client. The vulnerability resides in the client's tunnel protocol processing layer, where a memory region of unspecified but described as 'small' size can be exfiltrated under adversarially controlled tunnel conditions. No CWE was assigned by the reporter, but the behavior is characteristic of an improper memory boundary check or buffer over-read during packet processing (analogous to CWE-125 or CWE-200), where data adjacent to an intended read is inadvertently surfaced through the protocol response. The CVSS 4.0 vector (AV:N/AC:H/AT:P/UI:A) encodes that the attack is network-reachable but requires specific preconditions (AT:P) and active interaction (UI:A), indicating the tunnel session must be actively in use and the attacker must be in a position to influence protocol messages.
RemediationAI
The primary remediation is upgrading the Absolute Security Secure Access client to version 14.55 or later, which is identified as the fixed release based on the description's 'versions prior to 14.55' boundary. Refer to the vendor vulnerability archive at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40956 for official upgrade guidance and any deployment-specific instructions. If immediate upgrading is not feasible, the practical compensating control is ensuring that tunnel communications traverse only trusted, authenticated network infrastructure, thereby denying the attacker the 'total control over the tunnel protocol' that exploitation requires - however, this is a network-level architectural constraint rather than a configuration toggle, and its efficacy depends entirely on the deployment topology. No workarounds that eliminate the underlying code defect are available in the absence of a patch.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today