CVE-2026-40953
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to version 14.55. Attackers with local access and administrator privileges can cause a denial of service against the client they control.
Risk Assessment
The risk involves a local denial of service attack on the Secure Access client by a privileged user, potentially disrupting network resource access.
Recommendation
It is recommended to update Secure Access clients to version 14.55 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Secure Access
See all- CVE-2026-97717Medium
CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.
- CVE-2026-97716High
CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.
- CVE-2026-97715High
Vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.
- CVE-2026-97714High
Vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.
- CVE-2026-55402Medium
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.
- CVE-2026-55401Medium
CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.
- CVE-2026-55400Medium
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
- CVE-2026-55398Low
A memory management vulnerability in Secure Access clients and servers prior to version 14.55 allows attackers with intimate knowledge and full control over the tunnel protocol to perform a non-persistent DoS against the server.
- CVE-2026-33445Medium
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).
- CVE-2026-33444Low
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a non-persistent denial of service (DoS) against the server.
Original NVD description (English source)
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS