EUVD-2026-58115
GHSA-8pcf-2r89-jjr2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no auth, no complexity; availability impact is low because the server continues to function and failover is preserved.
Primary rating from Vendor (netmotionsoftware).
CVSS VectorVendor: netmotionsoftware
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
AnalysisAI
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.
Technical ContextAI
The vulnerability resides in the load-balancing subsystem of Absolute Secure Access (formerly NetMotion Mobility), an enterprise zero-trust network access and VPN platform. A null pointer dereference is triggered when the load-balancing component processes a malformed or unexpected unauthenticated network packet; because no null-check guards the dereference, the load balancer process faults and crashes. The CWE classification was not formally assigned in NVD data, but the description text and null-dereference characterisation are consistent with CWE-476 (NULL Pointer Dereference). Affected versions are all Secure Access server releases prior to 14.57, as identified in the vendor advisory at absolute.com. No CPE string was provided, so the exact component boundary within the product stack is inferred from the description alone.
RemediationAI
Upgrade Absolute Secure Access servers to version 14.57 or later, which contains the vendor-released patch for this null dereference. The canonical advisory with upgrade guidance is at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55401. If an immediate upgrade is not feasible, disabling the load-balancing feature on Secure Access servers eliminates the vulnerable code path entirely; this trade-off sacrifices load distribution and automatic failover capability for the duration of the interim period. Network-level filtering to restrict which IP ranges can send unauthenticated packets to the Secure Access server's load-balancer port can reduce exposure, though this does not address the root cause and requires knowledge of the specific service port used by the load-balancing subsystem.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Buffer overflow in Absolute Secure Access Windows client versions prior to 14.50 allows local attackers with high privil
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today