CVE-2026-40957
Absolute Secure Access ≤ 14.55
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-40957 is a medium-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Absolute Secure Access. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-44791
Vulnerability Data
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Frameable login page (CWE-1021) enables clickjacking on a malicious site to phish admin credentials via spearphishing link.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection devices or web server configurations can enforce X-Frame-Options or CSP frame-ancestors directives to block malicious framing of the login page.
Access enforcement mechanisms ensure the login page cannot be rendered inside an attacker-controlled frame, directly blocking the clickjacking vector used to steal credentials.
Secure configuration settings on the Secure Access server can mandate anti-framing HTTP headers on the login page prior to version 14.55.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require implementing frame-ancestors / X-Frame-Options controls that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing frame protections, but does not itself implement the control.
Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.
Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.
Secure architecture principles include isolation of UI layers and proper use of browser security controls.
Secure coding practices directly require implementation of frame-busting headers or CSP frame-ancestors directives.