Absolute Security vulnerabilities
We track 11 vulnerabilities in Absolute Security products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Absolute Security vulnerabilities
- 9.4 Critical severity
Secure Access: Cross-Site Request Forgery
CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- 9.3 Critical severity
Secure Access: Improper Authentication
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
- 8.7 High severity
Secure Access: Uncontrolled Resource Consumption
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
- 7.1 High severity
Secure Access: Uncontrolled Resource Consumption
CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.
- 8.2 High severity
Secure Access: Uncontrolled Resource Consumption
CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
- 7.5 High severity
Secure Access: Improper Restriction of Rendered UI Layers or Frames
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
- 7.8 High severity
Secure Access: Incorrect Default Permissions
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is
- 7.5 High severity
Secure Access: Uncontrolled Resource Consumption
CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash
- 7.2 High severity
Secure Access: Deserialization of Untrusted Data
CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administrative access to the console can cause unsafe content to be deserialized and executed in the security c
- 7.5 High severity
Secure Access: Mismatched Memory Management Routines
There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity
- 8.4 High severity
Secure Access: Untrusted Pointer Dereference
There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid add