{"id":"CVE-2026-116768","kind":"vulnerability","aliases":["CVE-2026-116768"],"related":[],"title":"Secure Access servers: missing length check lets logged-in users cause lasting outage","description":"CVE-2026-116768 is a missing length validation vulnerability\nin Secure Access servers prior to 14.61. Authenticated attackers can cause a\npersistent denial of service when connecting for the first time.","summary":"Secure Access servers before 14.61 do not validate the length of some input. An authenticated user who connects for the first time can trigger a persistent denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","secure-access","vpn-gateway"],"not_affected_if":["already-on-14.61-or-later"],"how_to_check":"- Check the installed Secure Access server version against the fixed range below","fix":"- Secure Access servers: move to `14.61` or later","status":"open","published_at":"2026-11-02T21:17:25+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","triaged_at":"2026-11-02T21:37:04+00:00","updated_at":"2026-11-02T21:37:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T21:37:04Z","model":"claude-haiku-5-5","output":{"fix":"- Secure Access servers: move to `14.61` or later","reach":"unknown","title":"Secure Access servers: missing length check lets logged-in users cause lasting outage","impact":"medium","summary":"Secure Access servers before 14.61 do not validate the length of some input. An authenticated user who connects for the first time can trigger a persistent denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["secure-access","vpn-gateway"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"persistent denial of service on the access server","analyst_note":"","how_to_check":"- Check the installed Secure Access server version against the fixed range below\n- unknown for the exact version command, as the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["already-on-14.61-or-later"],"who_is_affected":"Organisations running Secure Access servers before 14.61 are exposed. The attacker must hold valid credentials to connect to the server. Sources do not say which deployment modes or default settings are involved, so the rest is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":4092,"output_tokens":428,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116768':17A,20A,59C '-2026':16A,19A,58C '14.61':32B,72C 'access':2A,24B,29B,68C 'attack':74C 'authent':42B,73C 'caus':12A,76C 'check':6A 'connect':45B,83C 'cve':15A,18A,57C 'denial':54B,79C 'first':48B,86C 'gateway':27B 'infrastructur':21B 'input':40B 'last':13A 'length':5A,37B,63C 'let':7A 'log':9A 'logged-in':8A 'miss':4A,62C 'outag':14A 'persist':53B,78C 'prior':70C 'secur':1A,23B,28B,67C 'secure-access':22B 'server':3A,30B,69C 'servic':56B,81C 'time':49B,87C 'trigger':51B 'user':11A,43B 'valid':35B,64C 'vpn':26B 'vpn-gateway':25B 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Secure Access servers before 14.61 are exposed. The attacker must hold valid credentials to connect to the server. Sources do not say which deployment modes or default settings are involved, so the rest is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","secureaccess","vpngateway"],"first_public_at":"2026-11-02T21:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"SecurityResponse@netmotionsoftware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116768","severity":null,"published_at":"2026-11-02T21:17:25+00:00","modified_at":"2026-11-02T21:17:25+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","fetched_at":"2026-11-02T21:35:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}