Absolute Secure Access CVE-2026-97716

Exploitation requires only network reachability to the connection-setup subsystem of an Absolute Secure Access server running a version prior to 14.60 - no authentication (PR:N), no user interaction (UI:N), and no special product configuration is indicated by the description. The primary limiting factor is network exposure of the Secure Access server to the attacker and the server being on an affected version below 14.60; deployments already upgraded to 14.60 or with the connection-setup interface restricted to trusted networks are not exploitable. Impact is confined to availability (persistent service outage); no data or integrity compromise is possible via this flaw.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a remote, unauthenticated attacker over the network can send crafted traffic with low complexity and no user interaction to cause a high availability impact, with no confidentiality or integrity consequences. The 8.7 'High' score is driven entirely by the VA:H availability dimension - this is a pure denial-of-service issue, not a code-execution or data-exposure flaw, so despite the high score the blast radius is limited to service uptime. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so this is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation status is 'none' observed, technical impact is partial-to-total availability loss only, and automatability is plausible given AV:N/AC:L/PR:N but unconfirmed. Net: a genuine high-priority patch for availability-sensitive deployments (the persistent/non-self-recovering nature raises urgency), but it does not carry the compromise risk its 8.7 rating might superficially suggest. The 'persistent' qualifier is notable - recovery likely requires manual intervention/restart rather than resolving on its own.

A remote attacker with network reachability to an internet-facing or internally-exposed Absolute Secure Access server sends specially crafted traffic to the connection-setup subsystem without any credentials or user interaction. This drives the service into a persistent denial-of-service state, cutting off remote/VPN access for all legitimate users until an operator manually intervenes. No public proof-of-concept is currently identified.