CVE-2026-55401 Null dereference in Secure Access
Unauthenticated attackers can crash the internal load balancer of Secure Access servers by sending a crafted packet, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55401?
CVE-2026-55401 is a medium-severity vulnerability in Absolute Secure Access, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weakness: CWE-476
Which versions are affected by CVE-2026-55401?
It affects 1 product.
Products include Absolute Secure Access.
How do I fix CVE-2026-55401?
No fix has been published for CVE-2026-55401 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55401 being exploited?
There is no known exploitation of CVE-2026-55401 in the wild and no public exploit code.
Other vulnerabilities in Absolute Secure Access
- CVE-2026-55402 Denial of service in Secure Access
- CVE-2026-33445 Memory management vulnerability in Secure Access servers
- CVE-2025-49080 Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54
- CVE-2026-40952 Privilge misconfiguration in Secure Access installers
- CVE-2026-33451 Arbitrary read/write vulnerability in Windows clients prior to 14.50
Sources
Also known as GHSA-8pcf-2r89-jjr2.