EUVD-2026-44803Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the requirement for intimate protocol knowledge and tunnel control; impact is non-persistent availability-only, so A:L with C:N and I:N.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
AnalysisAI
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol knowledge and tunnel control to trigger a non-persistent denial-of-service against the server component. Both client and server software are identified as affected per the vendor's own disclosure. No public exploit code and no CISA KEV listing are confirmed at time of analysis, and the non-persistent DoS nature implies the server likely auto-recovers, constraining operational impact.
Technical ContextAI
Absolute Secure Access - CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:* - is an enterprise remote access and VPN platform evolved from NetMotion Mobility, used heavily in government, law enforcement, and healthcare sectors. The vulnerability resides in the product's proprietary tunnel protocol implementation, where improper memory management (no CWE assigned by NVD, but consistent with CWE-400 Uncontrolled Resource Consumption or CWE-119 Improper Restriction of Memory Operations) can be triggered by specially crafted tunnel traffic. The non-persistent crash-and-recover behavior suggests memory exhaustion or improper buffer handling that does not result in persistent state corruption. No CWE was formally assigned, which limits root-cause classification confidence.
RemediationAI
The primary and definitive fix is to upgrade Absolute Secure Access to version 14.55 or later, which resolves the underlying memory management flaw. Organizations should consult the vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55398 for deployment-specific guidance. For environments unable to patch immediately, compensating controls include restricting tunnel endpoint exposure to known and authenticated client IP ranges, deploying network-level monitoring for anomalous or malformed tunnel protocol traffic, and ensuring server auto-restart policies are in place to minimize downtime if a DoS is triggered. These controls reduce the attack surface but do not eliminate the vulnerability - upgrading to 14.55 remains the only confirmed remediation.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today