Vulnerabilidades do Absolute Secure Access

CVE-2026-40951 Média · 5.5 CWE-400 30/04/2026

Memory corruption in Secure Access Windows clients prior to 14.50

CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger a denial of service.

CVE-2026-40950 Média · 6.5 CWE-121 30/04/2026

Buffer overflow in the Secure Access server prior to 14.50

CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service

CVE-2026-40949 Média · 4.4 CWE-121 30/04/2026

Buffer overflow in Windows clients prior to 14.50

CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to trigger a denial of service.

CVE-2026-33452 Média · 5.5 CWE-121 30/04/2026

Buffer overflow in Windows clients prior to 14.50

CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to ‘blue screen’ the system.

CVE-2026-33451 Alta · 7.8 CWE-125 30/04/2026

Arbitrary read/write vulnerability in Windows clients prior to 14.50

CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and elevate their level of privilege to system.

CVE-2026-33450 Média · 5.5 CWE-125 30/04/2026

Out of bounds read in Secure Access MacOS clients prior to 14.50

CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50. Attackers with control of a modified server can send a malformed packet to the client causing a denial of service.

CVE-2026-33449 Alta · 7.5 CWE-121 30/04/2026

Message handler buffer overflow in clients prior to 14.50

CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a cryptographically valid message to the client, overwriting a small portion of memory conceivably leading to a denial of service.

CVE-2026-33448 Baixa · 3.3 CWE-200 30/04/2026

Format string vulnerability in MacOS clients prior to 14.50

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets.

CVE-2026-33447 Crítica · 9.8 CWE-121 30/04/2026

Stack-based Buffer Overflow em Absolute Secure Access

CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or denial of service.

CVE-2026-33446 Crítica · 9.8 CWE-120 30/04/2026

Buffer overflow in client authentication prior to version 14.50

CVE-2026-33446 is a buffer overflow in the authentication sub-system of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or a denial of service.

CVE-2026-0519 Baixa · 3.4 CWE-532 16/01/2026

Information Disclosure in Secure Access Between 12.70 and 14.20

In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.

CVE-2026-0518 Média · 4.8 CWE-79 16/01/2026

XSS in Secure Access Consoles prior to 14.20

CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console.

CVE-2026-0517 Alta · 7.5 CWE-400 16/01/2026

Denial of Service in Secure Access Servers Prior to 14.20.

CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash

CVE-2025-59596 Média · 6.5 CWE-20 04/11/2025

Improper Input Validation em Absolute Secure Access

CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send a crafted packet and cause the client system to crash.

CVE-2025-59595 Alta · 7.5 CWE-20 04/11/2025

Improper Input Validation em Absolute Secure Access

CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash.

CVE-2025-54089 Baixa · 3.4 CWE-79 02/10/2025

Cross-site Scripting vulnerability in Secure Access prior to 14.10

CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges required to execute the attack are high and the victim must actively participate in the attack sequence. There is no impact to confidentiality or availability, there is a low impact to integrity.

CVE-2025-54088 Média · 6.1 CWE-601 02/10/2025

Open Redirect in Secure Access prior to 14.10

CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.

CVE-2025-54087 Baixa · 2.6 CWE-918 02/10/2025

Server-side request forgery in Secure Access

CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. The attack complexity is high, there are no attack requirements, and user interaction is required. There is no direct impact to confidentiality, integrity, or availability. There is a low severity subsequent system impact to integrity.

CVE-2025-54086 Baixa · 3.3 CWE-276 02/10/2025

Excess Permissions in Warehouse

CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability.