Absolute Secure Access: Denial of service in authentication sub-system
Summary
Absolute Secure Access, a remote-access product, contains a denial-of-service vulnerability in its authentication sub-system. An attacker can send a malformed response during authentication, which can cause a persistent denial of service on the server. According to the CVSS 4.0 vector, the attack needs no privileges or user interaction and can be carried out over the network, but the attack complexity is high.
Affected
- Absolute Security Secure Access server versions prior to 14.60 (per CNA record: 0 to < 14.60)
- Unknown: exact list of older branches; check your build against the vendor advisory
Fixed in
- Secure Access 14.60
Workaround
- No vendor workaround found. Upgrading to 14.60 is the only confirmed remediation.
- Interim measure (not from a vendor source): restrict network access to the authentication endpoints.
Exploitation
- CISA SSVC (Vulnrichment): exploitation none, not automatable, technical impact partial.
- Not listed in CISA KEV.
- No public proof of concept found.
- One aggregator reports unclear sensor data; not treated as evidence of attacks.
Our recommendation
- Confirm the Secure Access server version. Any version below 14.60 is affected.
- Schedule the upgrade to 14.60 with the related fixes CVE-2026-97715, CVE-2026-97716 and CVE-2026-97717.
- Check whether scripts depend on the retired server-side APIs and test them before upgrading.
- Limit internet exposure of the authentication endpoints where business needs allow.
- Monitor for crashes or unexpected service restarts and plan for a possible manual restart.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Absolute CVE-2026-97714 advisory www.absolute.com
- Absolute Secure Access 14.60 advisory www.absolute.com
- CVE record (CVE List V5) raw.githubusercontent.com
- OpenCVE CVE-2026-97714 app.opencve.io
- VulDB CVE-2026-97714 vuldb.com
- OffSeq radar CVE-2026-97714 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:54.
Original description (NVD)
CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.