CVE-2026-8992
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
Risk Assessment
The risk includes remote code execution on the client, which could lead to system compromise and data theft.
Recommendation
Immediately upgrade Ivanti Secure Access Client to version 22.8R6 or later.
Other vulnerabilities in Ivanti Secure Access Client
See all- CVE-2026-7432High
A race condition in Ivanti Secure Access Client before version 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM.
- CVE-2026-7431Medium
An incorrect permission assignment for a critical resource in Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
Original NVD description (English source)
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS