EUVD-2026-58114
GHSA-rvwx-fgxf-5vwq
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires both authenticated session (PR:L) and non-default configuration (AC:H); impact is availability-only with no confidentiality or integrity consequence and no scope change.
Primary rating from Vendor (netmotionsoftware).
CVSS VectorVendor: netmotionsoftware
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
AnalysisAI
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific prerequisites must both be satisfied: (1) the attacker must hold an authenticated session on the Secure Access server - the PR:L CVSS metric confirms unauthenticated attackers cannot reach the vulnerable code path; and (2) the target server must be running in a non-default configuration, meaning default deployments are not directly exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.0 accurately reflects a moderate risk profile shaped by competing signals: the network attack vector (AV:N) means a remote attacker can trigger the flaw without physical access, but AC:H and PR:L together impose meaningful barriers - a valid authenticated session and a non-default server configuration must both be present. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is upgrading Absolute Secure Access server to version 14.57 or later, which the vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55400 confirms resolves this integer underflow. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today