EUVD-2026-44805Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid Secure Access tunnel credentials
-
DeliveryAuthenticate to publisher component
-
ExploitSend crafted resource-exhausting requests or connections
-
ExecutionPublisher resources depleted, availability degraded
-
ImpactService self-recovers without operator intervention
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Valid credentials to the Secure Access tunnel are required; unauthenticated exploitation is not possible per the CVSS 4.0 PR:L metric. The CVSS 4.0 UI:P (passive interaction) metric suggests the attack may require a legitimate session or connection to be in progress, though the precise interaction is not further detailed in the vendor description. Only the publisher component of Secure Access is affected; other product components are not identified as vulnerable. The DoS is explicitly described as non-persistent, meaning no persistent service disruption or data loss results. Exploitation is bounded to users or systems that have been provisioned with tunnel access credentials. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 5.1) characterizes this as a network-reachable, low-complexity flaw requiring low privileges and passive user interaction with only limited availability impact on the vulnerable system. The PR:L requirement is a meaningful limiting factor: exploitation is gated behind valid Secure Access tunnel credentials, ruling out anonymous internet-wide attacks. The non-persistent nature of the DoS - the publisher recovers without manual intervention - further constrains real-world impact. No KEV listing and no POC code are identified, consistent with a Medium-severity, internally patched issue with limited attacker incentive. EPSS data was not provided; risk is expected to be low given the authenticated prerequisite and self-healing behavior. This is a prioritize-if-patch-is-available issue rather than an emergency response item. |
| Exploit ScenarioDerived | An attacker who has obtained valid Secure Access tunnel credentials - whether legitimately issued or through credential compromise - connects to the publisher and sends crafted or repeated requests designed to exhaust publisher resources. The publisher becomes temporarily unable to serve legitimate users until resources are released. Because no public POC exists and the DoS is non-persistent, this scenario is most relevant to insider-threat or compromised-credential contexts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Resource exhaustion in Absolute Security Secure Access publisher (versions prior to 14.55) enables authenticated remote attackers holding valid tunnel credentials to trigger a non-persistent denial of service against the publisher component. The CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact: availability loss is limited and self-recovering, with no confidentiality or integrity exposure. No public exploit code and no CISA KEV listing identified at time of analysis.
RemediationAI
Upgrade Absolute Security Secure Access to version 14.55 or later, which resolves this resource exhaustion condition. The vendor advisory is available at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55399. If immediate patching is not feasible, limit the pool of users granted valid tunnel credentials to the minimum necessary set, reducing the potential attacker population. Network-level controls restricting tunnel access to known-good IP ranges or VPN segments can further narrow exposure, though these controls do not eliminate the vulnerability. Note that the DoS is non-persistent; the publisher self-recovers, so operational impact of any exploitation is transient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Absolute Security Secure Access is a zero-trust network access (ZTNA) and endpoint security platform. The publisher is the server-side component responsible for managing and brokering encrypted tunnel sessions from authenticated endpoints. The flaw is a resource exhaustion condition - an attacker abuses the tunnel connection or session-handling logic to over-consume server resources (memory, threads, connections, or similar), degrading publisher availability. No CWE was assigned by the vendor, but the description aligns with CWE-400 (Uncontrolled Resource Consumption). The affected product is identified by CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*, covering all versions prior to 14.55.
Know when Secure Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-accessible DoS gated by valid tunnel credentials (PR:L); no confidentiality or integrity impact, only limited self-recovering availability loss (A:L).
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
1DescriptionCVE.org
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Secure Access
View allUnauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running vers
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to caus
CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12.
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
GitHub PoC
Exploit-DB