Absolute Secure Access: Denial of service in connection setup

Summary

A flaw in the connection setup sub-system of Absolute Secure Access servers prior to version 14.60 allows unauthenticated remote attackers to send specially crafted traffic to the server. This causes a persistent denial of service, so remote users cannot connect. The CVE record describes no data loss or code execution, and the attack requires no credentials or user interaction.

Affected

• Absolute Secure Access server versions before 14.60 (CNA range 0 to below 14.60)
• Server component only; VulDB describes the range as up to 14.59

Fixed in

• Secure Access 14.60 (vendor advisory lists CVE-2026-97716 under this version)

Workaround

• No vendor workaround known.
• Third-party suggestion (VulDB, not confirmed by Absolute): rate limit new connections from untrusted networks.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Not listed in CISA KEV.
• No public proof of concept or exploitation reports found; search was not exhaustive.
• EPSS 0.00344.

Our recommendation

• Verify the installed Secure Access server version.
• Update all servers prior to 14.60 to version 14.60 promptly, starting with internet-facing servers.
• Check whether other Secure Access CVEs from the 14.60 advisory apply, such as CVE-2026-97714 and CVE-2026-97715.
• Restrict public exposure to the required VPN port and monitor for connection failures or service outages.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Vendor advisory (CVE entry) www.absolute.com
• Vendor 14.60 advisory www.absolute.com
• NVD/CNA data via OpenCVE app.opencve.io
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:24.