CVE-2026-40953
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to version 14.55. Attackers with local access and administrator privileges can cause a denial of service against the client they control.
Risk Assessment
The risk involves a local denial of service attack on the Secure Access client by a privileged user, potentially disrupting network resource access.
Recommendation
It is recommended to update Secure Access clients to version 14.55 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Secure Access
See all- CVE-2026-55402High
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.
- CVE-2026-55401Medium
CVE-2026-55401 is a null dereference vulnerability in the load-balancing subsystem of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients.
- CVE-2026-55400Medium
CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service.
- CVE-2026-55398Low
A memory management vulnerability in Secure Access clients and servers prior to version 14.55 allows attackers with intimate knowledge and full control over the tunnel protocol to perform a non-persistent DoS against the server.
- CVE-2026-33445Medium
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).
- CVE-2026-33444Low
A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a non-persistent denial of service (DoS) against the server.
- CVE-2026-40958Low
CVE-2026-40958 is an input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
- CVE-2026-40956Low
CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.
- CVE-2026-40955Low
CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.
- CVE-2026-40954Low
CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to version 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a non-persistent denial of service (DoS) against their client.
Original NVD description (English source)
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.