CVE-2026-40956: Absolute Secure Access Memory Disclosure Flaw

CVE-2026-40956 Overview

CVE-2026-40956 is a memory disclosure vulnerability affecting Absolute Secure Access client versions prior to 14.55. An attacker with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak from the client. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability requires high attack complexity and user interaction, which limits realistic exploitation scenarios. Absolute has published an advisory describing the affected component and remediation guidance in the Absolute Security Advisory.

Critical Impact
Attackers who fully control the tunnel protocol channel can leak small, random fragments of client process memory, potentially exposing residual sensitive data.

Affected Products

Absolute Secure Access client versions prior to 14.55
Component: absolute:secure_access
Vendor: Absolute

Discovery Timeline

2026-07-15 - CVE-2026-40956 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-40956

Vulnerability Analysis

CVE-2026-40956 is an information disclosure flaw in the tunnel protocol handling of the Absolute Secure Access client. The client fails to fully constrain the boundaries of data returned over the tunnel, allowing a portion of adjacent process memory to be included in responses. Because the disclosed content is random and small in volume, exploitation is opportunistic rather than targeted. Sensitive data recovery depends on what happens to reside in memory at the time of the leak.

Root Cause

The root cause is improper handling of buffer contents during tunnel protocol processing, consistent with [CWE-200]. The client returns more data to the protocol peer than was intended, exposing uninitialized or residual memory. Only an attacker with detailed knowledge of the tunnel protocol and full control over its messages can trigger the condition, which is why the attack complexity rating is high.

Attack Vector

The attack is delivered over the network through the Secure Access tunnel. The adversary must position themselves as the protocol peer and craft malformed or unexpected tunnel messages that manipulate the client into returning extra bytes. User interaction is required, meaning the victim must initiate or maintain a session with the attacker-controlled endpoint. Each successful exchange yields a small, random slice of memory, so meaningful data extraction would require repeated interactions.

No verified proof-of-concept code is publicly available for CVE-2026-40956.
See the vendor advisory for technical remediation details.

Detection Methods for CVE-2026-40956

Indicators of Compromise

Absolute Secure Access client processes running versions earlier than 14.55 in the environment.
Unusual or malformed tunnel protocol traffic originating from unexpected peers.
Repeated short-lived tunnel sessions from the same remote endpoint attempting to elicit responses.

Detection Strategies

Inventory endpoints and audit installed Absolute Secure Access client versions against the fixed release 14.55.
Inspect network telemetry for anomalous tunnel session patterns, including malformed handshakes and abnormally frequent reconnects.
Correlate client logs with network flow data to identify sessions terminating with protocol errors.

Monitoring Recommendations

Enable verbose logging on Secure Access clients where supported and forward logs to a central SIEM for analysis.
Alert on outbound Secure Access tunnel connections to endpoints outside the approved list of corporate gateways.
Track EPSS trends for CVE-2026-40956 to reassess urgency if exploit likelihood increases beyond the current low baseline.

How to Mitigate CVE-2026-40956

Immediate Actions Required

Upgrade all Absolute Secure Access client installations to version 14.55 or later.
Restrict Secure Access clients to connect only to trusted, corporate-controlled gateways.
Review network segmentation to reduce the attacker's ability to impersonate a tunnel peer.

Patch Information

Absolute has released a fixed version of the Secure Access client. Administrators should deploy version 14.55 or later across all managed endpoints. Refer to the Absolute Security Advisory for authoritative release information and download links.

Workarounds

Enforce endpoint policies that prevent Secure Access clients from initiating tunnels to non-approved servers.
Use network controls to block outbound Secure Access protocol traffic to untrusted destinations until patching is complete.
Educate users to avoid connecting to unfamiliar or unsanctioned Secure Access endpoints, since user interaction is required for exploitation.

bash

# Verify installed Absolute Secure Access client version on Windows
reg query "HKLM\SOFTWARE\Absolute\Secure Access" /v Version

# On macOS/Linux managed fleets, query package inventory
# and confirm version is >= 14.55