CVE-2026-40958: Absolute Secure Access DoS Vulnerability

CVE-2026-40958 Overview

CVE-2026-40958 is an input validation vulnerability [CWE-20] in Absolute Secure Access clients prior to version 14.55. An attacker with intimate knowledge of and total control over the tunnel protocol can send crafted traffic that triggers a non-persistent denial of service (DoS) against the client. The impact is limited to client-side availability, and the condition does not persist after client restart.

Critical Impact
Attackers who fully control the tunnel protocol can cause a temporary DoS on the Absolute Secure Access client, disrupting endpoint connectivity until the client is restarted.

Affected Products

Absolute Secure Access client versions prior to 14.55
Windows endpoints running vulnerable Secure Access client builds
Deployments relying on the affected tunnel protocol implementation

Discovery Timeline

2026-07-15 - CVE-2026-40958 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-40958

Vulnerability Analysis

The vulnerability is an improper input validation flaw [CWE-20] in the tunnel protocol handling routines of the Absolute Secure Access client. When the client processes malformed protocol messages, it fails to correctly validate the incoming data and enters an error state that terminates client operation. The condition is non-persistent, meaning the client recovers after restart and no data is lost or altered.

Exploitation requires the attacker to possess intimate knowledge of the proprietary tunnel protocol and total control over the traffic delivered to the client. This high attacker precondition, combined with limited availability-only impact, is reflected in the low severity assessment. The EPSS probability is 0.209% (11th percentile), consistent with low observed exploitation likelihood.

Root Cause

The root cause is missing or insufficient validation of tunnel protocol fields before they are consumed by client parsing logic. Specific parsing paths do not enforce expected bounds, types, or state assumptions on adversary-controlled data. Complete technical parameters are not disclosed in the public advisory.

Attack Vector

The attack is network-based but requires the adversary to control the tunnel endpoint that the client communicates with. User interaction is required to establish the vulnerable session. Once connected, the attacker sends malformed tunnel protocol data that causes the client process to fail. The vulnerability does not affect confidentiality or integrity and produces no privilege escalation.

No public proof-of-concept code is available. Refer to the Absolute Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-40958

Indicators of Compromise

Unexpected termination or crash events of the Absolute Secure Access client process on affected endpoints
Repeated client reconnection attempts following malformed tunnel protocol responses
Endpoint connectivity loss correlated with connections to untrusted or unexpected tunnel endpoints

Detection Strategies

Monitor endpoint process telemetry for abnormal exits of the Secure Access client binary
Correlate client crash events with the remote peer address and session metadata to identify hostile tunnel endpoints
Alert when clients connect to tunnel gateways outside the approved corporate allow list

Monitoring Recommendations

Collect and centralize Absolute Secure Access client logs for availability and error events
Track version inventory across managed endpoints to identify hosts running clients older than 14.55
Baseline normal tunnel session durations and flag statistically short sessions ending in client failure

How to Mitigate CVE-2026-40958

Immediate Actions Required

Upgrade all Absolute Secure Access clients to version 14.55 or later
Inventory endpoints to confirm no vulnerable client versions remain in production
Restrict client connections to trusted, vendor-managed tunnel gateways only

Patch Information

Absolute has addressed CVE-2026-40958 in Secure Access client version 14.55. Administrators should consult the Absolute Security Advisory for release notes and upgrade guidance.

Workarounds

Enforce network policies that only allow the Secure Access client to reach authorized tunnel infrastructure
Educate users to avoid connecting to untrusted networks that could host malicious tunnel endpoints
Configure automatic client restart and health monitoring to reduce downtime from any triggered DoS condition

bash

# Verify installed Absolute Secure Access client version (Windows PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Where-Object { $_.DisplayName -like "*Absolute Secure Access*" } |
    Select-Object DisplayName, DisplayVersion