CVE-2026-40956 is a memory disclosure vulnerability affecting Absolute Security Secure Access client versions before 14.55. The flaw allows an attacker who has intimate knowledge of and total control over the tunnel protocol to leak a small amount of random memory from the client. The CVSS 4.0 base score is 2.1, indicating low severity due to network attack vector, high attack complexity, required user interaction, and limited confidentiality impact. There is no official remediation level or patch currently documented by the vendor.

An attacker with detailed knowledge and full control over the tunnel protocol can cause a small amount of random memory to leak from the Secure Access client. This could potentially expose sensitive information in memory, but the impact is limited given the low CVSS score and the complexity required to exploit the vulnerability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be aware of the risk but note that exploitation requires high complexity and user interaction. No specific mitigations are provided by the vendor at this time.