CVE-2026-40954 is an integer underflow vulnerability affecting the traffic parsing function in Absolute Security Secure Access clients before version 14.55. An attacker who fully controls the tunnel protocol and understands its internals can exploit this flaw to trigger a non-persistent denial of service condition on the client. The vulnerability is classified under CWE-191 (Integer Underflow). The CVSS 4.0 vector indicates network attack vector with high attack complexity, requiring partial user interaction and no privileges. No official remediation or patch has been documented as of the publication date.

The vulnerability enables a denial of service condition that is non-persistent, meaning the client may crash or become unavailable temporarily when processing specially crafted tunnel protocol traffic. There is no indication of data compromise, privilege escalation, or persistent impact. The low CVSS score reflects the limited impact and the complexity required to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure to untrusted tunnel protocol traffic and restrict access to the Secure Access client where possible. Monitor vendor communications for updates on patches or official mitigations.