EUVD-2026-44805Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible DoS gated by valid tunnel credentials (PR:L); no confidentiality or integrity impact, only limited self-recovering availability loss (A:L).
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.
AnalysisAI
Resource exhaustion in Absolute Security Secure Access publisher (versions prior to 14.55) enables authenticated remote attackers holding valid tunnel credentials to trigger a non-persistent denial of service against the publisher component. The CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact: availability loss is limited and self-recovering, with no confidentiality or integrity exposure. No public exploit code and no CISA KEV listing identified at time of analysis.
Technical ContextAI
Absolute Security Secure Access is a zero-trust network access (ZTNA) and endpoint security platform. The publisher is the server-side component responsible for managing and brokering encrypted tunnel sessions from authenticated endpoints. The flaw is a resource exhaustion condition - an attacker abuses the tunnel connection or session-handling logic to over-consume server resources (memory, threads, connections, or similar), degrading publisher availability. No CWE was assigned by the vendor, but the description aligns with CWE-400 (Uncontrolled Resource Consumption). The affected product is identified by CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*, covering all versions prior to 14.55.
RemediationAI
Upgrade Absolute Security Secure Access to version 14.55 or later, which resolves this resource exhaustion condition. The vendor advisory is available at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55399. If immediate patching is not feasible, limit the pool of users granted valid tunnel credentials to the minimum necessary set, reducing the potential attacker population. Network-level controls restricting tunnel access to known-good IP ranges or VPN segments can further narrow exposure, though these controls do not eliminate the vulnerability. Note that the DoS is non-persistent; the publisher self-recovers, so operational impact of any exploitation is transient.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today