CVE-2026-33444: Secure Access Server DoS Vulnerability

CVE-2026-33444 Overview

CVE-2026-33444 is a memory management vulnerability affecting Absolute Secure Access servers running versions prior to 14.55. The flaw resides in the tunnel protocol handling logic and is classified under [CWE-119] as an improper restriction of operations within the bounds of a memory buffer. An attacker with detailed knowledge of and full control over the tunnel protocol can trigger a non-persistent denial-of-service (DoS) condition against the server. The vulnerability is network-reachable and requires no authentication or user interaction. Exploitation impacts availability but does not compromise confidentiality or integrity of data on the affected system.

Critical Impact
A remote, unauthenticated attacker capable of crafting malformed tunnel protocol traffic can cause a non-persistent denial of service against the Secure Access server, disrupting remote access for connected users.

Affected Products

Absolute Secure Access server versions prior to 14.55
Tunnel protocol handling component of the Secure Access server
Downstream deployments relying on affected Secure Access server versions for remote connectivity

Discovery Timeline

2026-07-15 - CVE-2026-33444 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-33444

Vulnerability Analysis

The vulnerability is a memory management issue in the tunnel protocol implementation of Absolute Secure Access servers. Operations on memory buffers are not properly bounded, which aligns with the [CWE-119] classification. When the server processes malformed protocol messages, memory handling errors lead to a crash or unresponsive state. The impact is limited to availability: connected sessions are disrupted and new sessions cannot be established until the server recovers. Because the DoS is described as non-persistent, the server returns to normal operation without permanent corruption of on-disk state. The EPSS probability at publication is 0.312%, indicating a low near-term likelihood of observed exploitation activity.

Root Cause

The root cause lies in how the Secure Access server parses and processes tunnel protocol frames. Memory buffer operations do not adequately validate size or structural constraints supplied by protocol peers. An attacker who understands the internal message format can construct inputs that drive the server into an invalid memory state, resulting in service failure.

Attack Vector

The attack vector is network-based. An attacker sends crafted tunnel protocol traffic to the exposed Secure Access server endpoint. No credentials and no user interaction are required. The attacker must, however, have intimate knowledge of the tunnel protocol and the ability to control the traffic sent to the server. Successful exploitation results in a temporary loss of the remote access service.

No public proof-of-concept exploit code is available for CVE-2026-33444. Technical details are referenced in the Absolute Security Advisory.

Detection Methods for CVE-2026-33444

Indicators of Compromise

Unexpected restarts, crashes, or unresponsiveness of the Secure Access server process without corresponding administrative action
Abrupt termination of active tunnel sessions across multiple clients in a narrow time window
Malformed or protocol-noncompliant tunnel frames observed in ingress network captures against the Secure Access server
Server logs showing memory-related faults or abnormal exits in the tunnel handler component

Detection Strategies

Monitor Secure Access server health metrics and generate alerts when the tunnel service restarts or stops responding to heartbeat checks
Inspect ingress traffic to the Secure Access server for tunnel protocol messages that violate expected size, sequence, or structural constraints
Correlate mass client disconnects with inbound network flows from a single or small set of source addresses

Monitoring Recommendations

Enable verbose logging on the Secure Access server tunnel component and forward logs to a centralized SIEM for correlation
Track service uptime and process crash counters as availability signals for the Secure Access server
Baseline normal tunnel protocol traffic volumes and flag statistical anomalies in packet size distribution or error rates

How to Mitigate CVE-2026-33444

Immediate Actions Required

Upgrade Absolute Secure Access servers to version 14.55 or later as documented in the vendor advisory
Restrict network reachability of the Secure Access server management and tunnel interfaces to trusted source ranges where feasible
Verify backup and failover configurations so that a DoS condition on a single server does not eliminate remote access capacity

Patch Information

Absolute has addressed CVE-2026-33444 in Secure Access server version 14.55. Administrators should consult the Absolute Security Advisory for exact upgrade instructions and confirm the running version after patching.

Workarounds

Place the Secure Access server behind network access controls that limit exposure of the tunnel endpoint to known client networks
Deploy rate limiting and anomaly detection at the network edge to reduce the impact of malformed protocol traffic bursts
Configure high-availability pairs or load-balanced clusters so that a non-persistent crash on one node does not interrupt service

bash

# Verify installed Secure Access server version and confirm it is 14.55 or later
# (run on the Secure Access server host; command name may vary by deployment)
secure-access-server --version