EUVD-2026-94583
GHSA-x6hf-62r6-phf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Secure Access auth endpoint
-
ExploitSend malformed authentication response
-
ImpactPersistent denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the authentication sub-system of an Absolute Secure Access server running a version prior to 14.60, and the ability to send a specifically malformed response during the authentication handshake. No authentication is required beforehand (PR:N), but the high attack complexity (AC:H) indicates the malformed response must meet specific conditions to trigger the persistent fault rather than being trivially reproducible. The limiting factors are: the server must be running an affected (<14.60) version and be reachable at its authentication interface; impact is confined to availability (service outage) with no confidentiality or integrity consequence; upgrading to 14.60 or later removes the exposure. |
| Impact | This is a credible but bounded-severity issue. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 HIGH and indicates a remote, pre-authentication condition (PR:N) with no user interaction, but with high attack complexity (AC:H) and impact limited exclusively to availability (VA:H; confidentiality and integrity are N). There is no data breach or code execution risk - the only outcome is a persistent denial of service. No EPSS score, CISA KEV listing, or POC is present in the provided intelligence, so exploitation is 'no public exploit identified at time of analysis,' and the AC:H rating suggests the malformed-response condition is not trivially reproducible. The single vendor reference (Absolute) confirms the affected product and fix line but no EPSS/KEV signal is available to gauge real-world exploitation probability. Net: a legitimate availability risk worth patching on internet-facing authentication gateways, but not the drop-everything priority the 8.2 score alone might imply, given the DoS-only impact, high complexity, and absence of any exploitation evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches the authentication endpoint of an Absolute Secure Access server (prior to 14.60) and sends a specially malformed response during the authentication exchange, triggering a fault that takes the authentication service down persistently and blocks legitimate users from connecting. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) implies the malformed response must satisfy specific conditions to trigger the fault. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to cause a persistent outage by sending a malformed response during the authentication handshake. The attack requires network access to the authentication interface and no authentication, but its high complexity (AC:H) means specific conditions must be met, limiting trivial exploitation; no public exploit code has been identified at time of analysis. Impact is confined to availability with no confidentiality or integrity consequences.
RemediationAI
Apply the vendor-released fix by upgrading Absolute Secure Access servers to version 14.60 or later; this is the definitive remediation. The official advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97714---8-2-high provides download and upgrade instructions. If immediate upgrade is not possible, restrict network access to the authentication subsystem so that only trusted clients can reach it, and monitor for repeated malformed authentication responses; however, this may limit legitimate remote access. Deploying rate limiting or connection throttling on the authentication interface may reduce the likelihood of a successful DoS, but such measures could introduce latency for legitimate users and are not confirmed to prevent the specific malformed response from triggering the persistent fault.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the authentication subsystem of Absolute Secure Access (CPE: cpe:2.3:a:absolute_security:secure_access), a secure remote access solution. All versions prior to 14.60 are affected. The CVSS v4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and the independent CVSS v3.1 assessment agree that a remote, unauthenticated attacker can trigger a high-availability impact with no effect on confidentiality or integrity. The high attack complexity indicates that the malformed response must be crafted to meet specific conditions during the authentication handshake to cause a persistent denial of service, likely by inducing a fault that the server does not recover from automatically. No CWE is assigned, but the root cause class is a denial-of-service condition due to insufficient handling of malformed authentication responses.
Know when Secure Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote pre-auth DoS (AV:N, PR:N, UI:N); AC:H reflects the specific malformed-response condition; only availability is affected (A:H), so C:N/I:N and scope unchanged.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
Executive ViewAI
Absolute Secure Access servers prior to version 14.60 are affected by a high-severity availability vulnerability that can cause a persistent outage of remote access services. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis. Leadership should prioritize interim network controls, monitoring, and patch readiness to reduce operational risk.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the authentication interface to trusted sources, implementing rate limiting or connection throttling, segmenting affected Absolute Secure Access servers, enabling enhanced logging and alerting for authentication handshake failures and outages, and ensuring redundancy/failover is operational.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Secure Access
View allUnauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running vers
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Exploit-DB