Absolute Secure Access CVE-2026-40958

Exploitation requires two simultaneous conditions: (1) the attacker must possess intimate knowledge of the Absolute Secure Access tunnel protocol, and (2) the attacker must have total control over the tunnel protocol - meaning they must either operate a rogue tunnel server, have compromised the legitimate server, or occupy a man-in-the-middle position capable of injecting or modifying tunnel traffic. The CVSS 4.0 vector also lists UI:P (passive user interaction), indicating the victim client must initiate or maintain a tunnel session for the attack to proceed. These conditions collectively eliminate drive-by or unauthenticated opportunistic exploitation. Exploitation is further limited by the non-persistent impact: the DoS does not persist across reconnections, and no confidentiality or integrity impact is possible under this attack path.

The overall real-world risk is very low. The CVSS 4.0 score of 2.3 is justified by the combination of AT:P (specific attack prerequisites required) and VA:L (low availability impact, non-persistent). The attacker must possess both intimate knowledge of the proprietary tunnel protocol AND total control over the tunnel - a bar that eliminates opportunistic or automated mass exploitation entirely. The non-persistent DoS nature means the client likely self-recovers upon reconnection or restart, with no data loss, integrity impact, or confidentiality exposure (VC:N, VI:N, SC:N, SI:N, SA:N). No EPSS score was provided, but given the niche product footprint and extreme exploitation prerequisites, real-world exploitation probability is expected to be negligible. No CISA KEV listing exists and no public exploit code has been identified. This is a low-priority patching item by every available signal - a routine update rather than an emergency response.

An attacker who operates or has compromised the tunnel endpoint that a Secure Access client connects to - or who has achieved a man-in-the-middle position on the tunnel - crafts malformed protocol messages exploiting the input validation gap. The victim client fails to handle the malformed data correctly and experiences a temporary service interruption (non-persistent DoS), after which normal connectivity is expected to resume. No public exploit code exists and this scenario requires a sophisticated, targeted attacker with deep protocol knowledge.