The vulnerability CVE-2026-40955 affects Absolute Security Secure Access clients before version 14.55. It is caused by an integer underflow in the traffic parsing function. Exploitation requires an attacker to have intimate knowledge and total control over the tunnel protocol used by the client. Successful exploitation results in a non-persistent denial of service condition against the client software. The CVSS 4.0 vector indicates network attack vector with high attack complexity, partial user interaction, and low impact on confidentiality, integrity, and availability.

An attacker with detailed knowledge and full control of the tunnel protocol can trigger a non-persistent denial of service on the Secure Access client. This disrupts client availability temporarily but does not affect confidentiality or integrity. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Absolute Security advisories for updates. Until a patch is available, limiting exposure to untrusted tunnel protocol traffic may reduce risk.