CVE-2026-116767

Overview

CVE-2026-116767 is an improper input handling flaw in Secure Access servers before version 14.61 that allows authenticated users to trigger a persistent denial of service. The vulnerability can keep the server unresponsive, disrupting legitimate access for all users. It is classified as high severity with a CVSS v3 score of 6.5 and a CVSS v4 score of 7.1.

Description

CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.

Impact

The flaw compromises Availability by enabling authenticated attackers to cause a persistent denial of service. Administrators and end‑users of the affected Secure Access servers are directly impacted, as the service becomes unusable until remediation. No confidentiality or integrity impact is reported.

Remediation

Apply the official patch that updates Secure Access to version 14.61 or later. If patching is delayed, restrict authentication to trusted users, disable or isolate the vulnerable input handling component, and enforce strict input validation or rate limiting. Monitor system logs for repeated malformed requests and block offending IPs as a temporary mitigation.

Risk context

With a high severity rating and CVSS scores of 6.5 (v3) and 7.1 (v4), the vulnerability poses a significant risk to service availability. Although EPSS data is unavailable, the impact warrants prompt action to prevent prolonged downtime.

Affected products

• Secure Access Server 14.60
• Secure Access Server 14.55
• Secure Access Server 14.50