EUVD-2026-44799Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the explicit 'intimate knowledge and total control over the tunnel protocol' prerequisite; A:L reflects non-persistent, self-recovering DoS only.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
AnalysisAI
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attacker who has intimate knowledge of and total control over the tunnel protocol. The attack exploits a memory management flaw in the server component, causing service disruption that does not persist after the attack ends, meaning the server recovers without administrator intervention. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the network-accessible attack surface warrants patching given Absolute Secure Access is a perimeter access product. Notably, the vendor-supplied tag includes 'Information Disclosure,' which conflicts with the DoS-only description and may indicate additional undisclosed impact.
Technical ContextAI
Absolute Secure Access is an enterprise VPN and remote network access solution from Absolute Security, identified in the CPE string as cpe:2.3:a:absolute_secutity:secure_access:*:*:*:*:*:*:*:* (note the apparent typo 'secutity' in the CPE vendor field). The vulnerability resides in the server-side memory management routines that handle the proprietary or standard tunnel protocol traffic. No CWE has been assigned by the vendor or NVD, which limits precise root-cause classification, but 'memory management vulnerability' broadly suggests improper allocation, freeing, or bounds tracking of tunnel protocol state - classes that map loosely to CWE-119 (buffer errors), CWE-401 (memory leak), or CWE-400 (uncontrolled resource consumption), though none can be confirmed from available data. The 'non-persistent' characterization implies the server process either crashes and restarts automatically or the memory state self-recovers, rather than entering a permanent degraded state.
RemediationAI
Upgrade Absolute Secure Access server to version 14.55 or later, which is the patched release indicated by the 'prior to 14.55' boundary in the vulnerability description. The vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33444 should be consulted for the official upgrade path, release notes, and any additional guidance. If immediate patching is not feasible, compensating controls should focus on restricting which clients and IPs can establish tunnel sessions to the Secure Access server - for example, enforcing allowlisting at the network perimeter so only known, authorized endpoints can reach the tunnel service, thereby raising the practical bar for an attacker to achieve the 'total control over the tunnel protocol' prerequisite. Note that such network-layer controls do not eliminate the vulnerability and should be treated as a temporary measure only.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today