Cyber Resilience

CVE-2026-40957

Absolute Secure Access ≤ 14.55

Published
15 July 2026
Modified
16 July 2026
Patch / advisory
CVSS Score v4 6.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0031 24th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-40957 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Absolute Secure Access. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

o   CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Why these techniques?

Frameable login page (CWE-1021) enables clickjacking on a malicious site to phish admin credentials via spearphishing link.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-55398Same product: Absolute Secure Access
CVE-2026-40954Same product: Absolute Secure Access
CVE-2026-33445Same product: Absolute Secure Access
CVE-2024-37351Same product: Absolute Secure Access
CVE-2024-37349Same product: Absolute Secure Access
CVE-2025-49080Same product: Absolute Secure Access
CVE-2024-40873Same product: Absolute Secure Access
CVE-2026-55399Same product: Absolute Secure Access
CVE-2026-0517Same product: Absolute Secure Access
CVE-2025-49082Same product: Absolute Secure Access

Affected Assets

absolute
secure access
≤ 14.55

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-7 Boundary Protection
  • AC-3 Access Enforcement
  • CM-6 Configuration Settings
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Boundary protection devices or web server configurations can enforce X-Frame-Options or CSP frame-ancestors directives to block malicious framing of the login page.

prevent

Access enforcement mechanisms ensure the login page cannot be rendered inside an attacker-controlled frame, directly blocking the clickjacking vector used to steal credentials.

prevent

Secure configuration settings on the Secure Access server can mandate anti-framing HTTP headers on the login page prior to version 14.55.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require implementing frame-ancestors / X-Frame-Options controls that prevent this weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect missing frame protections, but does not itself implement the control.

degrades

Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.

prevents

Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.

prevents

Secure architecture principles include isolation of UI layers and proper use of browser security controls.

prevents

Secure coding practices directly require implementation of frame-busting headers or CSP frame-ancestors directives.

References