CVE-2026-40951
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
CVE-2026-40951 is a memory corruption vulnerability in Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger a denial of service.
Risk Assessment
A local attacker can cause unavailability of the Secure Access client, potentially disrupting VPN connectivity and user productivity.
Recommendation
Update the Secure Access Windows client to version 14.50 or later.
Other vulnerabilities in Secure Access Windows client
See all- CVE-2026-40949Medium
CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to trigger a denial of service.
- CVE-2026-33452Medium
CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows client can use it to 'blue screen' the system.
- CVE-2026-33451High
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to version 14.50. Attackers with local control of the Windows client can send malformed data to an API and elevate their level of privilege to system.
- CVE-2025-59596Medium
A denial-of-service vulnerability exists in Secure Access Windows client versions 12.0 to 14.10, fixed in version 14.12. If a local networking policy is active, an attacker on an adjacent network may send a crafted packet and crash the client system.
Original NVD description (English source)
CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS