CVE-2026-33447 is a stack buffer overflow in a message parsing function of the Absolute Secure Access client before version 14.50. NVD scores it CVSS 9.8 (critical), but the vendor rates it 2.3 (low). The fix is version 14.50, so upgrade your clients.
What's affected
- Product: Absolute Secure Access client.
- Affected: versions prior to 14.50.
- Fixed: 14.50.
- Attack condition: the attacker controls a modified server and sends a special packet to the client.
How to check if you're exposed
Look up the Secure Access client version on each endpoint through your software inventory or the client's About screen. Anything below 14.50 needs the update. The vendor page lists no other checks or workarounds.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether Secure Access client is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- List the endpoints that have the Secure Access client installed.
- Update them to 14.50 or later.
- Limit connections to servers you control.
- Note the difference between the NVD and vendor scores in your ticket so reviewers see the reasoning.
Why it matters
The flaw sits in code that parses incoming messages. When the parser trusts the size of a field, a crafted packet can write past the end of a stack buffer. That is CWE-121, a stack based buffer overflow. The record says only a small area of memory can be overwritten, which could lead to memory corruption or denial of service.
NVD assigns 9.8 using CVSS 3.1. The vendor's CVSS 4.0 score is 2.3 and notes the need for a modified server and user interaction. This CVE is a sibling of CVE-2026-33446, fixed in the same release, and it is not in the CISA KEV catalog.
Quick check
Is CVE-2026-33447 critical?
NVD says 9.8, which is critical. The vendor page rates it 2.3, which is low. The attacker needs a modified server, so review both before choosing priority.
Sources
- https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33447
- https://nvd.nist.gov/vuln/detail/CVE-2026-33447
Last reviewed: 19 October 2026.
