Absolute Secure Access CVE-2026-55401

The load-balancing feature must be explicitly enabled on the Secure Access server - this is the sole configuration prerequisite. No authentication is required and no user interaction is needed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation with no complexity barrier against any Secure Access server with load balancing active and reachable on the network. Limiting factors: (1) load balancing must be enabled - servers without this feature configured are not vulnerable; (2) impact is bounded by the server's built-in failover capability, preventing persistent total-service denial; (3) the attack does not compromise confidentiality or integrity in any way.

The CVSS 4.0 base score of 6.9 (Medium) reflects the network-accessible, unauthenticated, zero-complexity attack surface, but is appropriately tempered by a low availability impact rating (VA:L) and the explicit vendor statement that the server continues to serve connections post-exploit. A minor discrepancy exists between the vendor-linked calculator vector (SA:L, implying some subsequent-system availability impact on connected clients during failover) and the officially submitted NVD vector (SA:N); the SA:L assessment appears more technically accurate given that clients must transition through failover. No EPSS score was provided, and there is no CISA KEV listing, no reported public POC, and no documented active exploitation - these absence-of-escalation signals collectively suggest the real-world exploitation priority is lower than the CVSS numeric score might imply. The DoS impact is self-limiting: because failover is preserved, attackers cannot achieve persistent denial of service through repeated packet injection without additional attack capability. For organizations with load balancing enabled and no quick patch path, the risk of targeted disruption to the load-distribution layer is real but bounded.

An attacker with network access to a Secure Access server that has load balancing enabled sends a single crafted unauthenticated packet to the load-balancer service port. The null dereference is triggered immediately upon processing, causing the internal load balancer process to crash. Connected clients experience a brief disruption and are redirected via failover; the server itself remains reachable, so the disruption window is limited to the failover convergence period.