CVE-2026-7431
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An incorrect permission assignment for a critical resource in Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
Risk Assessment
A local user can read or modify sensitive log data, potentially leading to information disclosure or tampering with evidence. This may weaken audit and monitoring capabilities.
Recommendation
Update Ivanti Secure Access Client to version 22.8R6 or later. Restrict local user privileges to the minimum necessary.
Other vulnerabilities in Ivanti Secure Access Client
See all- CVE-2026-8992High
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
- CVE-2026-7432High
A race condition in Ivanti Secure Access Client before version 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM.
Original NVD description (English source)
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS