Summary
Ein Angreifer kann mehrere Schwachstellen in Absolute Secure Access ausnutzen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
Product
Absolute Secure Access ist eine Sicherheitslösung, die einen sicheren Netzwerkzugriff für Endgeräte ermöglicht, unabhängig von deren Standort.
Vulnerabilities 4
-
Medium 6.0
Denial of Service in Secure Access Servers Prior to 14.20.
CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash
-
Medium 5.5
Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) an…
-
Medium 4.8
XSS in Secure Access Consoles prior to 14.20
CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console.
-
Medium 4.6
Information Disclosure in Secure Access Between 12.70 and 14.20
In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-3161, EUVD-2026-3162, EUVD-2026-3159
-
#1
Initiale Fassung
References
-
Absolute Security Advisory secure-access-1420 vom 2026-01-13
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1420