This vulnerability (CVE-2026-40958) affects Absolute Security Secure Access clients before version 14.55. It stems from improper input validation that can be exploited by attackers who have intimate knowledge and total control over the tunnel protocol to trigger a non-persistent denial of service condition on the client. The issue is categorized under CWE-20 (Improper Input Validation). The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack prerequisites, no privileges required, user interaction required, and low impact on availability with no impact on confidentiality or integrity.

The impact is limited to a non-persistent denial of service against the Secure Access client, which may disrupt client operations temporarily. There is no indication of data compromise, privilege escalation, or persistent service disruption. The low CVSS score reflects the limited impact and the requirement for attacker control over the tunnel protocol and user interaction.

No official patch or remediation level has been announced by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of tunnel protocol manipulation and limit exposure to untrusted networks or attackers with tunnel protocol control.