CVE-2026-40954

Modified Modified - Updated After Analysis

Integer Underflow in Secure Access Client Traffic Parsing

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: NetMotion Software

Description

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-40954

Affected Vendors & Products

Vendor	Product	Version / Range
absolute	secure_access	to 14.55 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients before version 14.55. Attackers with full control over the tunnel protocol can exploit this to cause a temporary denial-of-service (DoS) on the client.

Detection Guidance

Detection requires monitoring for unusual traffic patterns or crashes in Secure Access clients prior to version 14.55. Check client logs for parsing errors or unexpected terminations. No specific commands are provided in the available resources.

Impact Analysis

This vulnerability allows attackers to disrupt the service of Secure Access clients temporarily. It does not lead to data breaches or persistent damage but may cause service interruptions for users.

Compliance Impact

This vulnerability causes a non-persistent DoS attack on Secure Access clients, temporarily disrupting service. It does not directly impact confidentiality or integrity but may affect availability. Compliance impact depends on system criticality and downtime duration, potentially violating availability requirements in GDPR or HIPAA if service disruption occurs.

Mitigation Strategies

Upgrade all Secure Access clients to version 14.55 or later immediately. This addresses the integer underflow vulnerability in the traffic parsing function.

Hi! I’m here to help you understand CVE-2026-40954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70