CVE-2026-40956 is a memory disclosure vulnerability in Absolute Security Secure Access client software versions before 14.55. Exploitation requires an attacker to have intimate knowledge of and total control over the tunnel protocol, enabling them to leak a small amount of random memory from the client. The vulnerability has a CVSS 4.0 base score of 2.1, indicating low severity. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

An attacker who can fully control the tunnel protocol may cause leakage of a small amount of random memory from the Secure Access client. This could potentially expose sensitive information residing in memory, but the impact is limited due to the low amount of data leaked and the high attack complexity required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should limit exposure by restricting access to the tunnel protocol to trusted parties and monitor for unusual activity related to Secure Access clients.