CVE-2026-40958 is an input validation error affecting Absolute Security Secure Access clients before version 14.55. Exploitation requires attackers to have intimate knowledge of and total control over the tunnel protocol used by the client. Successful exploitation results in a non-persistent denial of service condition against the client software. The vulnerability is rated low severity with a CVSS 4.0 base score of 2.3. There is currently no vendor advisory or patch available, and no known exploits in the wild.

An attacker with detailed understanding and full control of the tunnel protocol can cause a temporary denial of service on the Secure Access client. This disrupts client availability but does not lead to persistent DoS or other impacts such as data compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure to attackers capable of controlling the tunnel protocol and monitor for unusual client disruptions.