Threat database

CVE-2026-97717 is a medium severity vulnerability in the proxy sub-system of Absolute Security's Secure Access servers prior to version 14.60. Authenticated attackers can send malformed data to cause a persistent denial of service condition. This vulnerability affects versions from 0 up to but not including 14.60.

CVE-2026-97716 is a high-severity vulnerability in the connection setup subsystem of Absolute Security's Secure Access servers prior to version 14.60. It allows unauthenticated attackers to send specially crafted traffic that causes a persistent denial of service condition.

CVE-2026-97715 is a high-severity vulnerability in Absolute Security Secure Access affecting versions prior to 14.60. It involves the client registration process where authenticated attackers can send malformed data to cause a persistent denial of service. The vulnerability has a CVSS 4.0 base score of 7.1. No known exploits are reported in the wild, and no official patch links are provided in the input data.

CVE-2026-97714 is a high-severity vulnerability in the authentication sub-system of Absolute Security Secure Access servers prior to version 14.60. It allows attackers to send a malformed response during authentication, resulting in a persistent denial of service condition. No known exploits are reported in the wild. The vulnerability affects versions from initial releases up to but not including 14.60.

CVE-2026-55402 is an out-of-bounds read vulnerability in Absolute Security Secure Access servers prior to version 14.57. An attacker positioned in the middle of the communication can send specially crafted data to cause a persistent denial of service condition on the server. The vulnerability has a high severity score of 8.7 and affects all versions before 14.57.

CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Absolute Security's Secure Access servers prior to version 14.57. An unauthenticated attacker can send a specially crafted packet to a Secure Access server with load balancing enabled, causing the internal load balancer to crash. Despite the crash, the server continues to accept connections and can still issue failover to connected clients. The vulnerability has a medium severity score of 6.9 (CVSS 4.0).

CVE-2026-55400 is an integer underflow vulnerability in Absolute Security Secure Access servers prior to version 14.57. An attacker with an authenticated session can send specially crafted traffic to a server configured in a non-default way, causing a persistent denial of service. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6. No known exploits are reported in the wild. The issue affects versions from initial releases up to but not including 14.57.

CVE-2026-55399 is a resource exhaustion vulnerability in Absolute Security's Secure Access publisher versions prior to 14.55. An attacker with valid credentials to the Secure Access tunnel can trigger a non-persistent denial-of-service (DoS) condition against the publisher. This vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.1. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

CVE-2026-55398 is a memory management vulnerability affecting Absolute Security's Secure Access clients and servers prior to version 14.55. This flaw allows attackers with detailed knowledge and full control over the tunnel protocol to cause a non-persistent denial-of-service (DoS) condition against the server. The vulnerability is classified as medium severity with a CVSS 4.0 base score of 6.9.

CVE-2026-33445 is a memory management vulnerability in Absolute Security's Secure Access servers prior to version 14.55. It allows attackers with detailed knowledge and full control of the tunnel protocol to cause a persistent denial-of-service (DoS) condition against the server. The vulnerability has a high severity with a CVSS score of 8.7. No official patch or remediation guidance has been provided yet by the vendor.

CVE-2026-33443 is a memory management vulnerability in Absolute Security Secure Access servers prior to version 14.55. It allows attackers with detailed knowledge and full control of the tunnel protocol to cause a persistent denial-of-service (DoS) condition against the server. The vulnerability has a high severity rating with a CVSS 4.0 base score of 7.1. No official patch or remediation guidance has been provided yet.

CVE-2026-40958 is an input validation vulnerability in Absolute Security Secure Access clients prior to version 14.55. This flaw allows attackers with detailed knowledge and full control of the tunnel protocol to cause a non-persistent denial of service (DoS) against the client. The vulnerability has a low severity rating and a CVSS score of 2.3. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-40957 is a medium-severity vulnerability in Absolute Security's Secure Access product. It involves a frameable content issue in the server login page prior to version 14.55. This flaw could allow attackers controlling a malicious website to potentially steal credentials from administrators who access the login page. No official patch or remediation guidance is currently provided by the vendor. The vulnerability does not appear to be actively exploited in the wild at this time.

CVE-2026-40956 is a low-severity memory disclosure vulnerability in Absolute Security's Secure Access client versions prior to 14.55. It allows attackers with detailed knowledge and full control over the tunnel protocol to cause a small amount of random memory to leak. The vulnerability does not have an official patch or remediation guidance published yet. Exploitation requires high attack complexity and user interaction, and no known exploits are reported in the wild.

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Absolute Security's Secure Access client software versions prior to 14.55. This flaw allows attackers who have detailed knowledge and full control over the tunnel protocol to cause a non-persistent denial of service (DoS) against the client. The vulnerability has a low severity rating and a CVSS score of 2.1. There is no official patch or remediation level currently stated by the vendor.

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Absolute Security's Secure Access client software versions prior to 14.55. This flaw allows attackers with detailed knowledge and full control over the tunnel protocol to cause a non-persistent denial of service (DoS) against the client. The vulnerability has a low severity rating and a CVSS score of 2.1. No known exploits are reported in the wild, and no official patch or remediation guidance has been provided yet.

CVE-2026-40953 is a heap overflow vulnerability in the certificate parsing function of Absolute Security's Secure Access client software versions prior to 14.55. This vulnerability requires local attacker access with administrator permissions and can be exploited to cause a denial of service condition on the affected client.

CVE-2026-40952 is a privilege misconfiguration vulnerability in Absolute Security's Secure Access Windows client and server. It affects versions prior to 14.55 when installed in a non-default location. An attacker with local access can exploit this issue to elevate privileges to Administrator. The vulnerability has a high severity score of 8.5 and involves improper privilege assignment during installation.

In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.

CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console.