CVE-2026-40954
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to version 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a non-persistent denial of service (DoS) against their client.
Risk Assessment
The risk involves a potential DoS attack by a privileged attacker, which can disrupt the Secure Access client and affect network service availability.
Recommendation
It is recommended to immediately upgrade Secure Access clients to version 14.55 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client