CVE-2026-33446 is a buffer overflow in the authentication subsystem of the Absolute Secure Access client before version 14.50. NVD scores it CVSS 9.8 (critical), while the vendor page rates it 2.3 (low). The fix is version 14.50, so upgrade clients and read both ratings before setting priority.
What's affected
- Product: Absolute Secure Access client.
- Affected: versions prior to 14.50.
- Fixed: 14.50.
- Attack condition: the attacker controls a modified server that the client connects to.
How to check if you're exposed
Check the installed Secure Access client version on your endpoints through your software inventory or the client's About screen, and compare it with 14.50. The vendor advisory is the place to confirm anything beyond that.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether Secure Access client is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- Identify every endpoint running the Secure Access client.
- Upgrade to 14.50 or later.
- Make sure clients connect only to servers you operate and trust.
- Read the vendor page and record why you chose your priority, given the gap between the scores.
Why it matters
A buffer overflow in authentication code means the client copies more data than a buffer can hold. According to the record, a modified server can send a special packet that overwrites a small portion of memory, which could cause memory corruption or a crash. The weakness class is CWE-120, a classic buffer copy without size checking.
The scores disagree. NVD lists CVSS 3.1 at 9.8 with a network vector and no privileges. The vendor page shows a CVSS 4.0 score of 2.3, reflecting that the attacker must control the server and the high attack complexity. Both are useful inputs. This CVE is not in the CISA KEV catalog.
Quick check
Which version fixes CVE-2026-33446?
Secure Access client 14.50. Versions before it are affected.
Sources
- https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33446
- https://nvd.nist.gov/vuln/detail/CVE-2026-33446
Last reviewed: 19 October 2026.
