CVE-2026-116768 identifies a missing length validation check in Secure Access servers running versions prior to 14.61. The flaw allows an authenticated user to make a first‑time connection that results in a persistent denial of service, leaving the service unavailable for the session and possibly for subsequent sessions. The weakness arises from improper input validation, causing a denial of service condition.

Absolute Software's Secure Access product is impacted. All installations using a release version older than 14.61 are affected. No additional build identifiers are provided beyond the major release number.

The CVSS score is 7.1, indicating a high impact if the flaw is exploited. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw requires authenticated access and a first‑time connection attempt, suggesting an internal or remote attack vector once credentials are obtained. The overall risk is moderate to high and could be exacerbated in environments where many users initiate new connections.