EUVD-2026-44791Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges required, but user interaction is mandatory; scope change reflects credential theft enabling high integrity impact on the Secure Access management plane.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
AnalysisAI
Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks that can result in administrator credential theft. An attacker who controls a malicious website can embed the login page in a hidden iframe, luring an unwitting administrator to unknowingly submit their credentials into the framed interface. No public exploit has been identified at time of analysis, and the CVSS 4.0 vector indicates active user interaction is required, limiting opportunistic exploitation.
Technical ContextAI
The vulnerability stems from the Secure Access server login page failing to set adequate framing-prevention headers - specifically X-Frame-Options or a Content-Security-Policy frame-ancestors directive. Without these controls, any third-party origin can embed the login page in an iframe. This is a classic UI redress (clickjacking) weakness: by layering the legitimate login iframe transparently over a malicious page, the attacker intercepts credentials the administrator believes they are submitting to a trusted interface. The affected CPE is cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*, covering all Secure Access versions prior to 14.55. No CWE was assigned in the NVD record; the appropriate classification would be CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). Absolute Security is the reporting vendor.
RemediationAI
Upgrade Absolute Secure Access to version 14.55 or later, which is the vendor-identified fix boundary per the advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40957. As a compensating control for organizations unable to patch immediately, administrators should be instructed to always navigate directly to the Secure Access login URL rather than following links in emails or messages, and to verify the page origin before entering credentials. Web application firewalls or reverse proxies placed in front of the login page can be configured to inject X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none' response headers as an interim mitigation; note this requires proxy access to the login endpoint and may conflict with existing SSO frame embedding if any is in use.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Share
External POC / Exploit Code
Leaving vuln.today