What is CVE-2026-55401?

CVE-2026-55401 is a medium-severity vulnerability in Absolute Secure Access, classified under NULL Pointer Dereference. CVSS score: 5.3/10. Published 2026-08-13.

How severe is CVE-2026-55401?

Medium severity. CVSS v3 base score is 5.3 out of 10.

NULL pointer dereference in Absolute Secure Access

CVE-2026-55401

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful attack, the Secure Access server is still able to accept connections and is still able to issue a failover to connected clients. ‍ https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Published 2026-08-13 · last modified 2026-09-04.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.004 (31.9th percentile), scored 2026-09-28.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001

Affected products

Absolute Secure Access
Absolute Security Secure Access — versions 0

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-5… (Vendor Advisory)

Frequently asked questions

What is CVE-2026-55401?: CVE-2026-55401 is a medium-severity vulnerability in Absolute Secure Access, classified under NULL Pointer Dereference. CVSS score: 5.3/10. Published 2026-08-13.
How severe is CVE-2026-55401?: Medium severity. CVSS v3 base score is 5.3 out of 10.