Ivanti Secure Access Client CVE-2026-7431

Exploitation requires the following specific conditions: (1) the attacker must be an authenticated local user on the system running Ivanti Secure Access Client (AV:L, PR:L from CVSS), (2) the affected version must be prior to 22.8R6 (vendor confirmation of fix version required), (3) the shared memory section used by the Secure Access Client for logging must be accessible and writable by the authenticated user (the core permission flaw), and (4) no special user interaction is needed (UI:N). This attack does NOT require root or administrator privilege; any authenticated local user can exploit it. Limiting factors include: single-user systems (only one account accessing the system at a time) substantially reduce practical risk, and systems with mandatory access control (MAC) frameworks such as SELinux or AppArmor may provide additional protection if configured to restrict shared memory access. Non-patched versions with hardened file system permissions (e.g., umask restrictions) may limit exploitation but are not a reliable mitigation since the vulnerability is in the application's IPC mechanism, not file-system permissions.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates a locally exploitable vulnerability requiring authentication with low complexity and no user interaction. The impact is limited to confidentiality and integrity of log data (C:L, I:L) with no availability impact (A:N), yielding the moderate 4.4 score. However, the real-world risk depends on deployment context: in environments where multiple authenticated users share access to the same system (shared workstations, multi-tenant hosts, or privilege-escalation scenarios), this becomes practically exploitable. The ability to modify logs has secondary impact - an attacker can cover tracks of malicious activity, complicating incident response and forensics. Conversely, in single-user environments or air-gapped networks, the risk is substantially lower. The low CVSS score reflects that this requires prior authentication and local access, not a remote or pre-auth attack. No EPSS score, KEV listing, or public POC has been provided, suggesting limited public attention or exploitation at the time of analysis. This is a real but not urgent vulnerability for most deployments; priority should be higher in multi-user or shared-system scenarios.

An authenticated user with standard privileges logs into a system running Ivanti Secure Access Client version 22.8R5 or earlier. Using knowledge of the shared memory section's path and permissions, the attacker reads sensitive diagnostic or authentication logs to identify patterns of system administrator activity, then modifies log entries to remove evidence of failed access attempts or malicious activities. The attack requires no special tools beyond standard system utilities (e.g., shmget, shmctl on Unix/Linux) and completes in seconds.