EUVD-2026-58116
GHSA-fwr3-5whq-67v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MitM network positioning requirement justifies AC:H; no authentication needed (PR:N); impact is availability-only and persistent (A:H), with no confidentiality or integrity loss.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
3DescriptionCVE.org
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.
AnalysisAI
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Technical ContextAI
Absolute Security Secure Access is an enterprise secure network access and endpoint management platform. The vulnerability is an out-of-bounds read - a memory safety flaw in which the server reads beyond the allocated buffer boundary when processing externally supplied data. The input tags identify this as also related to buffer overflow behavior, suggesting the parsing or processing logic for incoming network data fails to validate length or boundary conditions before reading. The affected product is precisely identified by CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*, covering all Absolute Security Secure Access versions prior to 14.57. No CWE identifier was assigned by the reporter, which limits precise root-cause classification to the class described in the CVE text. The 'persistent' nature of the resulting denial of service implies a process crash or unrecoverable state rather than a transient hang.
RemediationAI
Upgrade Absolute Security Secure Access to version 14.57 or later, which is the vendor-confirmed patched release per the advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55402. If immediate patching cannot be applied, reduce MitM attack surface by enforcing strict network segmentation between Secure Access clients and servers, deploying certificate pinning or mutual TLS where supported by the product to prevent traffic interception, and restricting server exposure to trusted network segments only. Note that network-layer controls do not remediate the underlying memory safety flaw and carry the trade-off of reduced accessibility for legitimate remote users. Patching to version 14.57 is the definitive and only confirmed fix.
More in Secure Access
View allPersistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today