Absolute: >> Secure Access >> 13.05 Security Vulnerabilities
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure
Access Windows client prior to 14.50. Attackers with local control of
the Windows client can send malformed data to an API and elevate their
level of privilege to system.
CVSS Score
8.5
EPSS Score
0.001
Published
2026-04-30
CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access
Windows client prior to 14.50. Attackers with local control of the
Windows client can use it to ‘blue screen’ the system.
CVSS Score
5.9
EPSS Score
0.001
Published
2026-04-30
CVE-2026-33448 is a format string vulnerability in the logging subsystem
of Secure Access client for MacOS prior to 14.50. Attackers with
control of a modified server can force the client to dump the contents
of a small portion of memory to the log files potentially revealing
secrets.
CVSS Score
4.8
EPSS Score
0.001
Published
2026-04-30
CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or a denial
of service.
CVSS Score
2.3
EPSS Score
0.003
Published
2026-04-30
CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or denial of
service.
CVSS Score
2.3
EPSS Score
0.003
Published
2026-04-30
CVE-2026-0518 is a cross-site scripting vulnerability in versions of
Secure Access prior to 14.20. An attacker with administrative privileges
can interfere with another administrator’s use of the console.
CVSS Score
4.8
EPSS Score
0.002
Published
2026-01-17
In Secure Access 12.70 and prior to 14.20, the logging
subsystem may write an unredacted authentication token to logs under
certain configurations. Any party with access to those logs could read
the token and reuse it to access an integrated system.
CVSS Score
4.6
EPSS Score
0.001
Published
2026-01-17
CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure
Access Server prior to 14.20. An attacker can send a specially crafted packet
to a server and cause the server to crash
CVSS Score
6.0
EPSS Score
0.003
Published
2026-01-17
CVE-2025-59595 is an internally discovered denial of service
vulnerability in versions of Secure Access prior to 14.12. An attacker
can send a specially crafted packet to a server in a non-default
configuration and cause the server to crash.
CVSS Score
8.2
EPSS Score
0.003
Published
2025-11-04
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access
Windows client versions 12.0 to 14.10 that is addressed in version
14.12. If a local networking policy is active, attackers on an adjacent
network may be able to send a crafted packet and cause the client system
to crash.
CVSS Score
6.0
EPSS Score
0.002
Published
2025-11-04