CVE-2026-40957
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
Risk Assessment
The risk involves potential theft of administrator credentials, which could lead to unauthorized access to the Secure Access system and further network compromise.
Recommendation
Immediately update Secure Access Server to version 14.55 or later, which includes a fix that eliminates the frameable content vulnerability.
Other vulnerabilities in Secure Access Server
See all- CVE-2026-97718Critical
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
Original NVD description (English source)
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS