CVE-2025-59596: Absolute Secure Access DOS Vulnerability

CVE-2025-59596 Overview

CVE-2025-59596 is a denial-of-service vulnerability in the Absolute Secure Access Windows client. The flaw affects versions 12.0 through 14.10 and is fixed in version 14.12. When a local networking policy is active, an attacker on an adjacent network can send a crafted packet that causes the client system to crash. The weakness is classified as improper input validation [CWE-20]. The vulnerability requires network adjacency but no authentication or user interaction, limiting exploitation to attackers on the same broadcast domain or link-layer segment as the target endpoint.

Critical Impact
An adjacent-network attacker can crash Absolute Secure Access Windows clients by sending a single crafted packet, disrupting remote access connectivity for affected endpoints.

Affected Products

Absolute Secure Access Windows client version 12.0 through 14.10
Absolute Secure Access deployments with a local networking policy enabled
Windows endpoints running the vulnerable client on shared or untrusted network segments

Discovery Timeline

2025-11-04 - CVE-2025-59596 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59596

Vulnerability Analysis

The vulnerability resides in the packet-processing logic of the Absolute Secure Access Windows client. When a local networking policy is configured and active, the client accepts and parses packets received from adjacent network peers. A crafted packet triggers an unhandled condition in the client, resulting in a process or system crash. The issue maps to CWE-20 (Improper Input Validation), indicating that the client fails to adequately validate structure, length, or field values in received network data before acting on them.

Exploitation produces a denial-of-service condition only; there is no reported impact to confidentiality or integrity. However, because Absolute Secure Access provides remote connectivity for mobile and remote endpoints, a crash disrupts VPN sessions and can interrupt access to corporate resources until the client is restarted.

Root Cause

The root cause is insufficient validation of untrusted network input processed by the Windows client when a local networking policy is enforced. Malformed field values in a crafted packet drive the client into an error state that terminates execution rather than gracefully discarding the input.

Attack Vector

The attack requires adjacent-network access, meaning the attacker must be on the same layer-2 segment, VLAN, or shared wireless network as the victim. No authentication or user interaction is required. An attacker on a public Wi-Fi network, a shared corporate segment, or a compromised guest VLAN can transmit the crafted packet directly to a vulnerable client and cause it to crash.

No public proof-of-concept or exploit code has been published for this vulnerability. Refer to the Absolute Security Advisory for vendor-specific technical details.

Detection Methods for CVE-2025-59596

Indicators of Compromise

Unexpected termination or repeated crashes of the Absolute Secure Access client process on Windows endpoints
Windows Error Reporting or Application event log entries referencing the Secure Access client executable
Sudden loss of VPN connectivity on endpoints located on shared or public network segments

Detection Strategies

Monitor Windows Event Log channels Application and System for crash events tied to the Absolute Secure Access client binary
Correlate client crash events across multiple endpoints on the same network segment as an indicator of active exploitation
Inspect network traffic on adjacent segments for anomalous or malformed packets targeting Secure Access client ports

Monitoring Recommendations

Track the installed version of Absolute Secure Access across the fleet and alert on hosts running 12.0 through 14.10
Alert on repeated Secure Access process restarts within a short time window on the same endpoint
Review wireless and guest network telemetry for unauthorized devices attempting broadcast or unicast traffic to managed clients

How to Mitigate CVE-2025-59596

Immediate Actions Required

Upgrade all Absolute Secure Access Windows clients to version 14.12 or later
Inventory endpoints running affected versions and prioritize devices that regularly connect to untrusted or shared networks
Review whether a local networking policy is required; disable it on endpoints where it is not needed to eliminate the attack surface

Patch Information

Absolute has addressed CVE-2025-59596 in Absolute Secure Access Windows client version 14.12. Administrators should obtain the fixed release and deployment guidance from the Absolute Security Advisory.

Workarounds

Disable the local networking policy on the Secure Access client where operationally acceptable until the patch is deployed
Restrict endpoint exposure to untrusted networks by enforcing wired connections or trusted Wi-Fi profiles
Segment guest and public wireless networks from endpoints that require Absolute Secure Access

bash

# Example: query installed Absolute Secure Access client version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Absolute Secure Access*" } |
  Select-Object DisplayName, DisplayVersion