Secure Access CVE-2026-40957

The attacker must control a malicious website and successfully social-engineer an administrator into visiting it and actively entering credentials - the CVSS 4.0 UI:A metric confirms active interaction is required. The vulnerability is present on the Secure Access server login page in all versions prior to 14.55 and requires no authentication or special server-side configuration to exploit from the attacker's side. Exploitation is limited to scenarios where: (1) the administrator can be phished or redirected to an attacker-controlled URL, and (2) the administrator fails to verify the page origin before submitting credentials. Exploitation does not require any direct access to the Secure Access server itself. Non-administrative users are not referenced as targets in the description.

The CVSS 4.0 base score of 6.1 reflects a meaningful but not critical risk: AV:N/AC:L/AT:N/PR:N establish that exploitation is network-reachable with no configuration prerequisites, but UI:A (active user interaction) is a significant limiting factor requiring the administrator to visit and interact with a malicious site. The subsequent-system integrity impact (SI:H) is notable - stolen admin credentials could grant full control of the Secure Access management plane. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, making real-world exploitation at scale unlikely but not impossible for targeted attacks against specific organizations. This is not a fire-drill vulnerability, but administrative credential compromise carries asymmetric downstream risk in a network access control product. The absence of a scope change at the vulnerable-component level (VC:N/VI:L) versus high subsequent-system integrity (SI:H) accurately captures the real risk: the login page itself is not directly compromised, but the credentials it captures can be weaponized against the broader Secure Access environment.

An attacker registers a domain resembling an internal IT portal and hosts a page that invisibly overlays the Absolute Secure Access login page in a full-screen iframe. A phishing email or Slack message directs a Secure Access administrator to the malicious domain under a pretense (e.g., a fake password reset notice). The administrator enters their credentials, which are captured by the attacker, who then authenticates directly to the Secure Access management console to modify network access policies or exfiltrate endpoint data.