What is the CVSS score of CVE-2026-7432?

CVE-2026-7432 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ivanti Secure Access Client are affected by CVE-2026-7432?

CVE-2026-7432 is a local privilege escalation vulnerability in Ivanti Secure Access Client (versions before 22.8R6) that allows authenticated local users to gain SYSTEM-level control through a race…

How to fix or mitigate CVE-2026-7432?

Within 24 hours: Inventory all systems running Ivanti Secure Access Client and document current versions via endpoint management tools; notify affected user populations that local account compromise poses elevated risk. Within 7 days: Restrict local administrative access and enforce application whitelisting where feasible; deploy endpoint detection and response (EDR) rules to flag suspicious privilege escalation attempts on Ivanti processes; evaluate isolation or network segmentation of high-value systems. Within 30 days: Upgrade to Ivanti Secure Access Client 22.8R6 or later when available; apply principle of least privilege across user accounts to minimize local exploitation surface; conduct threat hunting for signs of past exploitation.

Ivanti Secure Access Client CVE-2026-7432

EUVD-2026-29486 HIGH

Race Condition (CWE-362)

2026-05-12 ivanti

GHSA-3p86-c4c4-99r5

Privilege Escalation Race Condition Ivanti

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 15:31 vuln.today

CVE Published

May 12, 2026 - 14:21 nvd

HIGH 7.8

DescriptionCVE.org

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM

AnalysisAI

Race condition in Ivanti Secure Access Client enables local privilege escalation to SYSTEM from low-privileged accounts. Affects versions before 22.8R6. An authenticated local user can exploit timing vulnerabilities in the client software to gain complete system control. While limited to local attack vector (requires existing access to the target system), the low attack complexity (AC:L) and lack of user interaction requirement (UI:N) make this exploitable once local access is achieved. No public exploit code identified at time of analysis, and EPSS risk scoring not yet available for this 2026 CVE.

Technical ContextAI

This vulnerability stems from a race condition (CWE-362), a time-of-check to time-of-use (TOCTOU) flaw where multiple threads or processes access shared resources without proper synchronization. Ivanti Secure Access Client, an enterprise VPN and secure remote access solution, runs components with elevated SYSTEM privileges on Windows endpoints. The race condition likely occurs during privileged operations where the client validates authorization or security state, then performs an action based on that validation - with a timing window where an attacker can modify the state between check and use. The CPE identifier cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:* indicates all versions prior to the fixed release are affected across all deployment platforms. Race conditions are particularly dangerous in security-critical software because they create non-deterministic exploitation opportunities that may bypass traditional security controls.

RemediationAI

Upgrade Ivanti Secure Access Client to version 22.8R6 or later, as confirmed by the official Ivanti security advisory at https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Secure-Access-Client-CVE-2026-7431-CVE-2026-7432. The vendor advisory should be consulted for deployment-specific upgrade procedures and any prerequisite patches. If immediate patching is not feasible, implement compensating controls by restricting local administrator privileges on endpoints running vulnerable clients, enforcing strict user access policies through Windows Group Policy to limit who can authenticate locally, and enhancing monitoring for unusual privilege escalation attempts via Windows Event ID 4672 (Special privileges assigned to new logon) and 4673 (A privileged service was called). Deploy endpoint detection and response (EDR) solutions configured to alert on processes spawning with SYSTEM privileges from user-initiated contexts. Note that these mitigations only reduce attack surface and do not eliminate the vulnerability - race conditions cannot be reliably prevented through external controls once an attacker has local authenticated access. Organizations must prioritize the vendor patch as the only complete remediation.