There is a memory management vulnerability in Absolute
Secure Access server versions 9.0 to 13.54. Attackers with network access to
the server can cause a Denial of Service by sending a specially crafted
sequence of packets to the server. The attack complexity is low, there are no
attack requirements, privileges, or user interaction required. Loss of
availability is high; there is no impact on confidentiality or integrity.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0011.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Absolute Security Secure Access unaffected
Version Status Constraints
9.0 affected
< 13.54

Configuration 1 [-]

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Absolute Subscribe
Secure Access Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-18200 There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49080 cve-icon cve-icon
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00055}

 epss

{'score': 0.0006}

Mon, 23 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Absolute
Absolute secure Access
CPEs cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*
Vendors & Products Absolute
Absolute secure Access
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 17 Jun 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-762
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Jun 2025 17:15:00 +0000

Type Values Removed Values Added
Description There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.
Title Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Absolute

Published:

Updated: 2025-06-17T18:17:08.994Z

Reserved: 2025-05-30T18:23:44.238Z

Link: CVE-2025-49080

cve-icon Vulnrichment

Updated: 2025-06-12T17:13:48.634Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-12T17:15:29.193

Modified: 2025-06-23T14:09:31.560

Link: CVE-2025-49080

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses