CVE-2026-0517 is a denial‑of‑service flaw in Absolute Security Secure Access servers. A malicious actor can send a specially crafted network packet to the server, causing the application to crash and halt service availability. The vulnerability does not affect confidentiality or integrity; its primary impact is to render the server unusable for legitimate users.

The flaw affects Absolute Security’s Secure Access product in all releases prior to version 14.20. Any deployment of Secure Access Server that has not been upgraded to 14.20 or later is susceptible to this denial‑of‑service condition.

The CVSS score of 6 classifies the issue as medium severity, while the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw can be triggered by a single network packet, the attack vector is inferred to be remote network access with no authentication required. While exploitation is relatively simple, the lack of widespread public exploitation data suggests an opportunity exists for targeted operators to cause outages.