Absolute Secure Access EUVD-2026-94580

Exploitation requires (1) network reachability to the Secure Access server and (2) a valid authenticated session, as reflected by PR:L in the vendor CVSS vector - this is NOT an unauthenticated flaw. The specific trigger is the client registration process: an authenticated attacker must send malformed data through that registration workflow to the server. The limiting factors that reduce real-world risk are the authentication prerequisite (an attacker needs working credentials) and the fact that impact is availability-only. The amplifying factor is that the resulting denial of service is persistent rather than transient, so a single successful request can have lasting operational effect. Affected deployments are Secure Access servers running versions prior to 14.60.

This is a genuine but moderate-priority availability issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low complexity, requires some authentication (PR:L), no user interaction, and impact is confined entirely to availability (VA:H) with no confidentiality or integrity loss. The 7.1 'High' score is driven solely by the persistent DoS impact, not by any data-exposure risk. Critically, the attacker must be authenticated (PR:L), which meaningfully narrows the threat population to users who already possess valid credentials to the Secure Access server, reducing the realistic risk versus an unauthenticated network flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or likely imminent exploitation. SSVC-style reading: exploitation status is 'none' (no public exploit identified), technical impact is partial (availability-only), and automatability is uncertain given the authentication requirement. Net: a real patching priority for exposed Secure Access gateways because the DoS is persistent (not merely transient), but it is not a drop-everything emergency absent exploitation signals. Note a minor tension to verify with the vendor: the description says 'persistent denial of service' but does not clarify whether recovery requires manual intervention/reinstall - if so, operational severity is higher than the raw score suggests.

An attacker who holds valid (possibly low-privilege) credentials to an Absolute Secure Access server submits crafted, malformed data through the client registration process. The malformed input is mishandled by the server, causing a persistent denial of service that keeps legitimate clients from connecting until the condition is remediated. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means a knowledgeable authenticated user could likely trigger it reliably once the registration flaw is understood.