CVE-2026-40957 is a frameable content vulnerability affecting the Secure Access server login page of Absolute Security products before version 14.55. The vulnerability allows an attacker who controls a malicious website to embed the login page in a frame, potentially enabling credential theft from administrators who interact with the framed login interface. The CVSS 4.0 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high scope impact. No official fix or remediation level has been published by the vendor as of the data provided.

An attacker with control of a malicious website could exploit this vulnerability to steal administrator credentials by framing the Secure Access server login page. This could lead to unauthorized access to the Secure Access system if credentials are compromised. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious when accessing the Secure Access login page from untrusted environments and consider implementing external mitigations such as frame-busting techniques or Content Security Policy (CSP) headers to prevent framing.