Absolute Secure Access

Buffer overflow in client authentication prior to version 14.50

CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or denial of service.

Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

Memory management vulnerability in Secure Access servers

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.

Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54

Arbitrary read/write vulnerability in Windows clients prior to 14.50

Privilge misconfiguration in Secure Access installers

CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash.

Frameable content vulnerability in the Secure Access server login page

Message handler buffer overflow in clients prior to 14.50

Denial of Service in Secure Access Servers Prior to 14.20.

Data deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

Buffer overflow in the Secure Access server prior to 14.50

Memory management error in Secure Access servers prior to 14.55

Privilege escalation in the management console of Absolute Secure Access prior to version 13.54

Input validation vulnerability in the Secure Access prior to version 13.55

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. ‍ https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Memory management vulnerability in Secure Access clients

Memory management vulnerability in Secure Access servers

Permissions bypass in the management console of Absolute Secure Access prior to version 13.54

Buffer overflow in Windows clients prior to 14.50

Memory corruption in Secure Access Windows clients prior to 14.50

Heap overflow in Secure Access clients

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.

Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash.

Open Redirect in Secure Access prior to 14.10

Buffer overflow in Windows clients prior to 14.50

Out of bounds read in Secure Access MacOS clients prior to 14.50

Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

Excess Permissions in Warehouse

Resource exhaustion vulnerability in the Secure Access publisher

Permissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06

XSS in Secure Access Consoles prior to 14.20

Format string vulnerability in MacOS clients prior to 14.50

Cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.54