Is CVE-2026-40957 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40957 being exploited in the wild.

How severe is CVE-2026-40957?

Informational severity, with a CVSS score of 6.1, published 15 July 2026.

Which products and versions are affected?

Absolute Security Secure Access prior to 14.55.

Is there a fix for CVE-2026-40957?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40957 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40957?

Check whether you run Absolute Security Secure Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40957: Absolute Security Secure Access clickjacking in server login page

CVE-2026-40957 · Severity: info · CVSS 6.1 · Published 2026-07-15

Absolute Security Secure Access, a tool used for secure remote connectivity, contains a vulnerability in its server login page. An attacker could trick an administrator into visiting a malicious website that embeds the legitimate login page within a hidden frame. This could allow the attacker to capture the administrator's login credentials, potentially leading to unauthorized access to the management console.

Technologies: Absolute Security Secure Access. Vendors: Absolute Security.

Quick answers

Is CVE-2026-40957 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40957 being exploited in the wild.
How severe is CVE-2026-40957?: Informational severity, with a CVSS score of 6.1, published 15 July 2026.
Which products and versions are affected?: Absolute Security Secure Access prior to 14.55.
Is there a fix for CVE-2026-40957?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40957 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40957?: Check whether you run Absolute Security Secure Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A frameable content vulnerability (clickjacking) exists in the Absolute Security (formerly NetMotion) Secure Access server login page. The application fails to properly implement frame-busting headers or Content Security Policy (CSP) directives like 'frame-ancestors', allowing the login interface to be embedded in an iframe on a third-party domain. An attacker can leverage this by enticing an authenticated administrator to visit a malicious site, where the attacker can overlay transparent layers to capture keystrokes or credentials. This issue is resolved in Secure Access version 14.55.

Affected products

Absolute Security (formerly NetMotion) Secure Access prior to 14.55

Timeline

2026-07-15: advisory
2026-07-15: disclosed

References

https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40957

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.