EUVD-2026-58114
GHSA-rvwx-fgxf-5vwq
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires both authenticated session (PR:L) and non-default configuration (AC:H); impact is availability-only with no confidentiality or integrity consequence and no scope change.
Primary rating from Vendor (netmotionsoftware).
CVSS VectorVendor: netmotionsoftware
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
AnalysisAI
Persistent denial of service is achievable in Absolute Secure Access (formerly NetMotion) server versions prior to 14.57 via an integer underflow triggered by specially crafted network traffic from an authenticated session. Exploitation is constrained by both a credential requirement and a non-default server configuration dependency, limiting opportunistic attack surface while still posing meaningful operational risk to affected deployments. No public exploit code or active exploitation has been identified at time of analysis; vendor patch at version 14.57 addresses the flaw.
Technical ContextAI
Secure Access is an enterprise VPN and network access platform developed by NetMotion Software, now part of Absolute Security. The vulnerability is an integer underflow - a condition where arithmetic on a signed or unsigned integer produces a value below the minimum representable, typically resulting in a wrapped or unexpectedly large value that corrupts downstream memory layout or length calculations. In this instance the underflow occurs within traffic-processing logic that handles authenticated client sessions, and its outcome is server instability or persistent unavailability rather than arbitrary code execution. This is consistent with the CVSS 4.0 vector, which records high availability impact (VA:H) and no confidentiality or integrity impact (VC:N/VI:N). No formal CWE was assigned in the NVD entry, but the described root cause maps to CWE-191 (Integer Underflow). The attack complexity rating of AC:H in the vendor-provided vector reflects the non-default configuration prerequisite, confirming the vulnerable code path is not reached in standard deployments.
RemediationAI
The primary remediation is upgrading Absolute Secure Access server to version 14.57 or later, which the vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55400 confirms resolves this integer underflow. As an interim compensating control prior to patching, administrators should audit and revert any non-default server configurations that may expose the vulnerable code path - since the description explicitly states the flaw requires a non-default configuration, restoring default settings may prevent exploitation while upgrade planning is underway, though the specific configuration parameter involved is not disclosed in available data. Additionally, restricting authenticated access to the Secure Access server to trusted network segments or jump hosts reduces the pool of potential attackers, though this does not eliminate risk from insiders or compromised credentials. Patching to 14.57 remains the only confirmed remediation.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today