CVE-2026-116769

Authentication bypass in Secure Access Servers

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-116767

Improper input handling in Secure Access servers

CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97718

CSRF in Secure Access Server v14.60

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server.  Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-116766

Improper input handling in Secure Access server

CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-116768

Missing length validation in Absolute Secure Access

CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97714

Denial of service vulnerability in Secure Access

CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97715

Denial of Service in Absolute Secure Access

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97716

Denial of Service in Absolute Secure Access

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97717

Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-55401

Null Dereference Vulnerability in Secure Access Load Balancer

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. ‍ https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-55400

Underflow‑Based Persistent Denial of Service in Absolute Secure Access

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-55402

Persistent Denial of Service via Out-Of-Bounds Read in Secure Access Servers

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40952

Privilge misconfiguration in Secure Access installers

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Absolute Microsoft

Products

Secure Access Windows

CVE-2026-40953

Heap overflow in Secure Access clients

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40954

Integer underflow in Secure Access clients prior to 14.55

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40955

Integer underflow vulnerability in Secure Access clients

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40956

Memory disclosure in Secure Access Clients

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40957

Frameable content vulnerability in the Secure Access server login page

o   CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40958

Input validation error in Secure Access clients prior to 14.55

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-33443

Memory management error in Secure Access servers prior to 14.55

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access