Absolute Secure Access EUVD-2026-94576

Requires valid authenticated access to the Absolute Secure Access server (CVSS PR:L) - this is not remote-unauthenticated. The attacker must then reach the proxy sub-system and submit malformed data that triggers the resource-exhaustion condition; the CVSS 4.0 AT:P metric indicates an additional precondition outside the attacker's direct control must be met. Exploitation is limited to Secure Access server versions prior to 14.60, and impact is restricted to availability (persistent DoS) with no confidentiality or integrity effect. The authentication requirement and attack precondition are the primary limiting factors reducing real-world exposure.

This is a genuine but mid-tier priority: a CWE-400 resource-exhaustion flaw causing persistent (not transient) denial of service in Absolute Secure Access servers before 14.60. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) shows network-reachable, low-complexity exploitation, but it requires authentication (PR:L) and carries an attack requirement (AT:P), meaning some condition outside the attacker's full control must hold. Impact is confined to availability (VA:H; VC:N/VI:N), so there is no data disclosure or integrity loss. Multiple signals agree that real-world urgency is moderate rather than critical: it is NOT in CISA KEV, SSVC reports Exploitation: none and Automatable: no with only partial Technical Impact, and no EPSS score was provided. The need for valid credentials substantially limits the attacker population, favoring insider or post-compromise abuse over mass unauthenticated exploitation. A vendor patch is available, which raises patch priority for exposed deployments. Note the data gap: no EPSS probability and no POC/exploitation evidence were supplied, so exploitability likelihood cannot be quantified - the low SSVC exploitation rating is the strongest available signal that this is not currently being weaponized.

An attacker who already holds valid (low-privilege) credentials to an Absolute Secure Access server below 14.60 authenticates and sends specially malformed data to the proxy sub-system, triggering uncontrolled resource consumption that crashes or hangs the service persistently, requiring manual intervention to restore. No public exploit code was identified, and the network vector with low complexity makes the request itself simple, but the authentication requirement (PR:L) means the attacker must first obtain access.