Absolute vulnerabilities
Published CVEs affecting Absolute products: 31 record(s), with severity, exploitation and fixes.
CVE-2026-55399
Medium · 4.3
CWE-400 Jul 15, 2026
Uncontrolled Resource Consumption in Absolute Secure Access
CVE-2026-55399 is a resource exhaustion
vulnerability in the Secure Access publisher prior to 14.55. Attackers with
valid credentials to the Secure Access tunnel can create a non-persistent DoS
against the publisher.
CVE-2026-55398
Low · 3.7
CWE-119 Jul 15, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Absolute Secure Access
CVE-2026-55398
is a memory management vulnerability in Secure Access clients and servers prior
to 14.55. Attackers with intimate knowledge of and total control over the
tunnel protocol can create a non-persistent DoS against the server.
CVE-2026-33445
Medium · 5.9
CWE-400 Jul 15, 2026
Uncontrolled Resource Consumption in Absolute Secure Access
CVE-2026-33445 is a memory management
vulnerability in Secure Access servers prior to 14.55. Attackers with an
intimate knowledge of and total control over the tunnel protocol can create a
persistent DoS against the server.
CVE-2026-33444
Low · 3.7
CWE-119 Jul 15, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Absolute Secure Access
CVE-2026-33444 is a memory management
vulnerability in Secure Access servers prior to 14.55. Attackers with intimate
knowledge of and total control over the tunnel protocol can create a
non-persistent DoS against the server.
CVE-2026-40958
Low · 3.7
CWE-20 Jul 15, 2026
Improper Input Validation in Absolute Secure Access
CVE-2026-40958
is a input validation error in Secure Access clients prior to 14.55. Attackers
with intimate knowledge of and total control over the tunnel protocol can
create a non-persistent DoS against their client.
CVE-2026-40957
High · 7.5
CWE-1021 Jul 15, 2026
Clickjacking in Absolute Secure Access
o
CVE-2026-40957 is a frameable content
vulnerability in the Secure Access server login page prior to 14.55. Attackers
with control of a malicious web site could use it to potentially steal
credentials from an unwary administrator.
CVE-2026-40956
Low · 3.7
CWE-200 Jul 15, 2026
Exposure of Sensitive Information in Absolute Secure Access
CVE-2026-40956
is a memory disclosure vulnerability in Secure Access client versions prior to 14.55.
Attackers with intimate knowledge of and total control over the tunnel protocol
can cause a small amount of random memory to leak.
CVE-2026-40955
Low · 3.7
CWE-191 Jul 15, 2026
Integer Underflow in Absolute Secure Access
CVE-2026-40955 is an integer underflow
vulnerability in the traffic parsing function of Secure Access clients prior to
14.55. Attackers with intimate knowledge of and total control over the tunnel
protocol can create a non-persistent DoS against their client.
CVE-2026-40954
Low · 3.7
CWE-191 Jul 15, 2026
Integer Underflow in Absolute Secure Access
CVE-2026-40954
is an integer underflow vulnerability in the traffic parsing function of Secure
Access clients prior to 14.55. Attackers with intimate knowledge of and total
control over the tunnel protocol can create a non-persistent DoS against their
client
CVE-2026-40953
Medium · 4.4
CWE-787 Jul 15, 2026
Out-of-bounds Write in Absolute Secure Access
CVE-2026-40953 is a heap overflow in the
certificate parsing function of Secure Access clients prior to 14.55. Attackers
with local access and administrator permissions can create a denial of service
attack against the client over which they have control.
CVE-2026-40952
High · 7.8
CWE-276 Jul 15, 2026
Incorrect Default Permissions in Absolute Secure Access
CVE-2026-40952 is a privilege misconfiguration
in the Secure Access installer for the Windows client and server prior to
version 14.55. Attackers with local access to the client or server can use it
to elevate privileges to Administrator when Secure Access is installed in a
non-default location.
CVE-2026-33443
Medium · 5.9
CWE-400 Jul 15, 2026
Uncontrolled Resource Consumption in Absolute Secure Access
CVE-2026-33443 is a memory management error in
Secure Access servers prior to 14.55. Attackers with an intimate knowledge of
and total control over the tunnel protocol can create a persistent DoS against
the server.
CVE-2026-40951
Medium · 5.5
CWE-400 Apr 30, 2026
Memory corruption in Secure Access Windows clients prior to 14.50
CVE-2026-40951 is a memory corruption vulnerability on Secure Access
Windows clients prior to 14.50. Attackers with local control of the
Windows client can send malformed data to an API and trigger a denial of
service.
CVE-2026-40950
Medium · 6.5
CWE-121 Apr 30, 2026
Buffer overflow in the Secure Access server prior to 14.50
CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access
server prior to 14.50. Attackers with control of a modified client can
send a specially crafted message to the server and cause a denial of
service
CVE-2026-40949
Medium · 4.4
CWE-121 Apr 30, 2026
Buffer overflow in Windows clients prior to 14.50
CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access
Windows client prior to 14.50. Attackers with local control of the
Windows client can use it to trigger a denial of service.
CVE-2026-33452
Medium · 5.5
CWE-121 Apr 30, 2026
Buffer overflow in Windows clients prior to 14.50
CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access
Windows client prior to 14.50. Attackers with local control of the
Windows client can use it to ‘blue screen’ the system.
CVE-2026-33451
High · 7.8
CWE-125 Apr 30, 2026
Arbitrary read/write vulnerability in Windows clients prior to 14.50
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure
Access Windows client prior to 14.50. Attackers with local control of
the Windows client can send malformed data to an API and elevate their
level of privilege to system.
CVE-2026-33450
Medium · 5.5
CWE-125 Apr 30, 2026
Out of bounds read in Secure Access MacOS clients prior to 14.50
CVE-2026-33450 is an out of bounds read vulnerability in the Secure
Access MacOS client prior to 14.50. Attackers with control of a modified
server can send a malformed packet to the client causing a denial of
service.
CVE-2026-33449
High · 7.5
CWE-121 Apr 30, 2026
Message handler buffer overflow in clients prior to 14.50
CVE-2026-33449 is a buffer overflow in a message handling function of
the Secure Access client prior to 14.50. Attackers with control of
a modified server can send a cryptographically valid message to the
client, overwriting a small portion of memory conceivably leading to a
denial of service.
CVE-2026-33448
Low · 3.3
CWE-200 Apr 30, 2026
Format string vulnerability in MacOS clients prior to 14.50
CVE-2026-33448 is a format string vulnerability in the logging subsystem
of Secure Access client for MacOS prior to 14.50. Attackers with
control of a modified server can force the client to dump the contents
of a small portion of memory to the log files potentially revealing
secrets.
CVE-2026-33447
Critical · 9.8
CWE-121 Apr 30, 2026
Stack-based Buffer Overflow in Absolute Secure Access
CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or denial of
service.
CVE-2026-33446
Critical · 9.8
CWE-120 Apr 30, 2026
Buffer overflow in client authentication prior to version 14.50
CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or a denial
of service.
CVE-2026-0519
Low · 3.4
CWE-532 Jan 16, 2026
Information Disclosure in Secure Access Between 12.70 and 14.20
In Secure Access 12.70 and prior to 14.20, the logging
subsystem may write an unredacted authentication token to logs under
certain configurations. Any party with access to those logs could read
the token and reuse it to access an integrated system.
CVE-2026-0518
Medium · 4.8
CWE-79 Jan 16, 2026
XSS in Secure Access Consoles prior to 14.20
CVE-2026-0518 is a cross-site scripting vulnerability in versions of
Secure Access prior to 14.20. An attacker with administrative privileges
can interfere with another administrator’s use of the console.
CVE-2026-0517
High · 7.5
CWE-400 Jan 16, 2026
Denial of Service in Secure Access Servers Prior to 14.20.
CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure
Access Server prior to 14.20. An attacker can send a specially crafted packet
to a server and cause the server to crash