Secure Access Windows client vulnerabilities

CVE-2026-40951 is a memory corruption vulnerability in Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger a denial of service.

CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to trigger a denial of service.

CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to 'blue screen' the system.

CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to version 14.50. Attackers with local control of the Windows client can send malformed data to an API and elevate their level of privilege to system.

A denial-of-service vulnerability exists in Secure Access Windows client versions 12.0 to 14.10, fixed in version 14.12. If a local networking policy is active, an attacker on an adjacent network may send a crafted packet and crash the client system.