The vulnerability CVE-2026-40955 affects Absolute Security Secure Access clients before version 14.55. It is caused by an integer underflow in the traffic parsing function. Exploitation requires attackers to have intimate knowledge of and total control over the tunnel protocol used by the client. Successful exploitation results in a non-persistent denial of service condition on the client. The CVSS 4.0 vector indicates network attack vector with high attack complexity and partial user interaction required, resulting in low impact on availability and no impact on confidentiality or integrity. No known exploits are reported in the wild, and no vendor-provided patch or official remediation level is documented.

The impact of this vulnerability is limited to a non-persistent denial of service against the Secure Access client. There is no indication of confidentiality or integrity compromise. The attack requires high complexity and partial user interaction, limiting the likelihood and scope of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by the vendor, users should monitor for updates from Absolute Security regarding patches or mitigations. Until a patch is available, restricting access to the tunnel protocol to trusted parties may reduce exposure.