EUVD-2026-44793Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the dual prerequisite of protocol expertise and full tunnel control; UI:R maps the passive client-session requirement; A:L for non-persistent availability impact only.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
AnalysisAI
Non-persistent denial-of-service affecting Absolute Secure Access clients prior to version 14.55 can be triggered by an attacker who possesses intimate knowledge of and total control over the underlying tunnel protocol, yielding low availability impact limited to the client process. The CVSS 4.0 score of 2.3 reflects the highly constrained exploitation requirements captured by AT:P and UI:P - this is not opportunistic exploitation but a targeted, condition-heavy attack against a specific client. No active exploitation has been identified, no public exploit code exists, and the DoS is explicitly described as non-persistent, meaning the client recovers without lasting damage.
Technical ContextAI
Absolute Secure Access is a corporate endpoint secure-access (VPN-style) client produced by Absolute Security, identified via CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*. The vulnerability class is an input validation error occurring within the tunnel protocol parsing logic of the client. Although no CWE was formally assigned (listed as N/A), the input validation error category typically aligns with improper validation of input (CWE-20) or related improper handling of malformed protocol data. The attack surface is the client-side tunnel protocol handler, meaning the vulnerable component processes data received over the network tunnel - making attacker control of the tunnel endpoint (e.g., a rogue or compromised server, or a man-in-the-middle position) a prerequisite for triggering the flaw.
RemediationAI
Upgrade Absolute Secure Access clients to version 14.55 or later, which is confirmed as the remediated release per the vendor description. The vendor's vulnerability archive at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40958 should be consulted for deployment guidance and any platform-specific instructions. Given the non-persistent nature of the DoS and the high exploitation bar, emergency out-of-band patching is not warranted; inclusion in the next routine patch cycle is appropriate. As a compensating control, restricting which servers clients are permitted to establish tunnels with (via allowlisting or strict certificate pinning on the tunnel endpoint) would eliminate the attacker's ability to control the tunnel protocol, effectively neutralizing the attack vector - though this may require configuration management overhead.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today