Read the docs
TI-2026-29605 Aliases CVE-2026-40954GHSA-h82q-53pj-q2j2

Integer underflow in Secure Access clients prior to 14.55

Priority LOW 11CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed Secure Access (Absolute Security): 14.55

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Absolute SecuritySecure Accessbefore 14.5514.55Patch availableCNA
  • Secure Access VendorAbsolute Security Affected before 14.55 Fixed in 14.55 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*before 14.55VulnerableAbsolute Security
  • cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:* Versions before 14.55 Vulnerable ·Absolute Security

Remediation

  • Fix · CNA Secure Access (Absolute Security) Fixed in 14.55

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Absolute Security Secure Access 14.55

    11 records Highest priority Priority MEDIUM 1 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2026-25841 Memory management vulnerability in Secure Access serversPriority MEDIUM 44
    • TI-2026-29603 Privilge misconfiguration in Secure Access installersPriority LOW 38
    • TI-2026-39968 Memory management vulnerability in Secure Access clientsPriority LOW 36
    Show all 11 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40954
  2. 2026-10-03 Alias added: GHSA-h82q-53pj-q2j2

References

Advisory 1

  • TI-2026-25841 Memory management vulnerability in Secure Access servers CVSS 4.0HIGH 8.7
  • TI-2026-39972 Out-of-bounds read in Absolute Security Secure Access CVSS 4.0HIGH 8.7
  • TI-2026-29603 Privilge misconfiguration in Secure Access installers CVSS 4.0HIGH 8.5
  • TI-2026-25847 Arbitrary read/write vulnerability in Windows clients prior to 14.50 CVSS 4.0HIGH 8.5
  • TI-2025-31193 Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54 CVSS 4.0HIGH 8.7
  • TI-2026-39971 NULL pointer dereference in Absolute Security Secure Access CVSS 4.0MEDIUM 6.9
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences