Secure Access vulnerabilities

CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. An authenticated attacker can cause a persistent denial of service when connecting for the first time.

CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. An authenticated attacker can cause a persistent denial of service.

CVE-2026-116766 is an improper input handling vulnerability in Secure Access server versions between 13.0 and prior to 14.61. An attacker can cause a persistent denial of service of the server.

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.

Vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.

Vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.

CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.

A memory management vulnerability in Secure Access clients and servers prior to version 14.55 allows attackers with intimate knowledge and full control over the tunnel protocol to perform a non-persistent DoS against the server.

A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).

A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a non-persistent denial of service (DoS) against the server.

CVE-2026-40958 is an input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to version 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a non-persistent denial of service (DoS) against their client.

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to version 14.55. Attackers with local access and administrator privileges can cause a denial of service against the client they control.

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for Windows client and server prior to version 14.55. Attackers with local access can exploit this to elevate privileges to Administrator when Secure Access is installed in a non-default location.

CVE-2026-33443 is a memory management error in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can create a persistent DoS against the server.

CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service.

CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to crash.

Cross-site scripting (XSS) vulnerability in Secure Access versions prior to 14.10. Attackers with administrative access to the console can interfere with another administrator's access. Low attack complexity, no attack requirements, high privileges required, victim must participate. No impact to confidentiality or availability, low impact to integrity.

CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.

Server-side request forgery (SSRF) vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. High attack complexity, no attack requirements, user interaction required. No direct impact to confidentiality, integrity, or availability, low subsequent system impact to integrity.