# CVE-2026-55399: Absolute Security Secure Access resource exhaustion in publisher

Source: https://junglewise.ai/threats/cve-2026-55399-absolute-security-secure-access-resource-exhaustion-in-publisher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-55399 · Severity: info · CVSS 5.1 · Published 2026-07-15

Absolute Security Secure Access is a remote access solution that allows employees to securely connect to corporate resources. A vulnerability in the publisher component allows a user with valid login credentials to overwhelm the system, causing a temporary service disruption. While the disruption is not permanent, it can prevent other legitimate users from accessing the network until the issue is resolved.

Technologies: [Absolute Security Secure Access](https://junglewise.ai/threats/technologies/secure-access). Vendors: [Absolute Security](https://junglewise.ai/threats/vendors/absolute-security).

## Quick answers

**Is CVE-2026-55399 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55399 being exploited in the wild.

**How severe is CVE-2026-55399?** Informational severity, with a CVSS score of 5.1, published 15 July 2026.

**Which products and versions are affected?** Absolute Security Secure Access prior to 14.55.

**Is there a fix for CVE-2026-55399?** A patch was published on 2026-07-15: Fix available in version 14.55. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55399 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55399?** Check whether you run Absolute Security Secure Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in the Absolute Security (formerly NetMotion) Secure Access publisher component in versions prior to 14.55. The flaw allows an authenticated attacker with valid tunnel credentials to trigger a non-persistent Denial of Service (DoS) condition. By consuming excessive system resources, the attacker can degrade or halt the publisher's ability to process legitimate traffic. The attack requires network reachability to the Secure Access tunnel and valid low-privileged user credentials. The issue is addressed in Secure Access version 14.55.

## Affected products

- Absolute Security (NetMotion Software) Secure Access prior to 14.55

## Timeline

- 2026-07-15: advisory: Advisory published by Absolute Security and NVD record created.
- 2026-07-15: patched: Fix available in version 14.55.

## References

- [https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55399](https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-55399)

## Related threats

- [Absolute Security Secure Access memory management denial of service](https://junglewise.ai/threats/cve-2026-55398-absolute-security-secure-access-memory-management-denial-of)
- [Absolute Security Secure Access memory management DoS in server](https://junglewise.ai/threats/cve-2026-33445-absolute-security-secure-access-memory-management-dos-in-server)
- [Absolute Security Secure Access memory management DoS](https://junglewise.ai/threats/cve-2026-33444-absolute-security-secure-access-memory-management-dos)
- [Absolute Security Secure Access input validation error in client tunnel protocol](https://junglewise.ai/threats/cve-2026-40958-absolute-security-secure-access-input-validation-error-in-client)
- [Absolute Security Secure Access clickjacking in server login page](https://junglewise.ai/threats/cve-2026-40957-absolute-security-secure-access-clickjacking-in-server-login-page)