CVE-2026-40950 is a buffer overflow that allows an attacker controlling a modified client to send a specially crafted message to the Secure Access server, causing a denial of service. The overflow is a classic stack‑based overflow condition matching CWE-121 and undermines the availability of the service.

The vulnerability affects Absolute Software’s Secure Access product in all builds prior to version 14.50. Any system that has not applied the 14.50 update is exploitable.

The CVSS score of 7.1 reflects a high potential for impact; the EPSS score of 0.00042 indicates a very low probability of exploitation, but the lack of a KEV listing suggests no known public exploits yet. The likely attack vector is a malicious client that injects the crafted packet, so the exploit is most feasible when an attacker can control or impersonate a client session. Because the flaw leads only to a denial of service, the breach compromises availability but does not provide escalation of privileges or data theft.