What is the CVSS score of CVE-2026-8051?

CVE-2026-8051 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Ivanti Virtual Traffic Manager are affected by CVE-2026-8051?

Ivanti Virtual Traffic Manager versions prior to 22.9r4 contain a remote code execution vulnerability that allows authenticated administrators to execute arbitrary commands, potentially compromising…

How to fix or mitigate CVE-2026-8051?

Within 24 hours: Inventory all Ivanti Virtual Traffic Manager deployments and document current versions. Within 7 days: Implement privileged access management (PAM) controls to restrict and monitor administrative account usage; disable or isolate instances running versions before 22.9r4 if feasible. Within 30 days: Upgrade all affected instances to version 22.9r4 or later as this patch becomes available from vendor.

Ivanti Virtual Traffic Manager CVE-2026-8051

EUVD-2026-29488 HIGH

OS Command Injection (CWE-78)

2026-05-12 ivanti

GHSA-3rm6-879f-q3r2

RCE Command Injection Ivanti

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 15:31 vuln.today

CVE Published

May 12, 2026 - 14:24 nvd

HIGH 7.2

DescriptionCVE.org

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

AnalysisAI

Remote code execution in Ivanti Virtual Traffic Manager allows authenticated administrators to execute arbitrary OS commands via command injection. Affects all versions before 22.9r4. Attack requires network access and administrative credentials but has low complexity (CVSS AC:L). No active exploitation confirmed at time of analysis, though administrative access requirement significantly limits attack surface compared to unauthenticated RCE vulnerabilities.

Technical ContextAI

Ivanti Virtual Traffic Manager (vTM) is a software-based application delivery controller and load balancer. This vulnerability stems from CWE-78 (OS Command Injection), where user-supplied input from an authenticated administrator is improperly neutralized before being passed to system command execution functions. The flaw allows attackers to break out of intended command contexts and inject additional operating system commands. Given the administrative interface context and network attack vector (AV:N), this likely affects the web-based management console or API endpoints that interact with underlying system processes. The CPE string (cpe:2.3:a:ivanti:virtual_traffic_manager:*:*:*:*:*:*:*:*) indicates all product variants are affected regardless of platform, with version constraint applying universally up to the fixed release.

RemediationAI

Vendor-released patch: upgrade to Ivanti Virtual Traffic Manager version 22.9r4 or later, as confirmed by Ivanti Security Advisory SA-2026-05 (https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US). This is the primary remediation path. Until patching is completed, implement compensating controls targeting the high-privilege requirement: enforce multi-factor authentication on all administrative accounts, restrict administrative console access to specific source IP addresses or management networks using firewall rules or access control lists, enable comprehensive audit logging of all administrative actions to detect potential exploitation attempts, and review administrative account usage for anomalous command execution patterns. Monitor for unusual process spawning from vTM management services. Note that IP-based restrictions may complicate legitimate remote administration and MFA adds operational overhead but both significantly raise attacker cost. Administrative session timeouts should be minimized to reduce credential exposure window. These mitigations do not eliminate the vulnerability but substantially reduce exploitability by protecting the prerequisite administrative access vector.