Ivanti Secure Access Client CVE-2026-8992

Exploitation requires the attacker to occupy a network position between the Ivanti Secure Access Client and its configured VPN gateway (e.g., shared Wi-Fi, compromised upstream router, ARP/DNS spoofing on a LAN), and the targeted user must initiate a VPN connection using the vulnerable client (UI:R) - the attack is not driveable without that user action. The vulnerability is in the client's TLS certificate validation logic, so any deployment using Ivanti Secure Access Client below 22.8R6 to authenticate gateways via TLS is exposed by default; no special non-default configuration is required to be vulnerable. Limiting factors: the user-interaction requirement means the attacker cannot trigger exploitation unilaterally, and users on trusted/managed networks where MitM is infeasible are practically out of reach.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation with high impact on confidentiality, integrity, and availability, but requires user interaction - typically initiating a VPN connection. EPSS and KEV data were not provided, and no public exploit identified at time of analysis, so this is not confirmed actively exploited. The realistic risk is elevated for organizations whose users connect from untrusted networks (cafés, hotels, conferences) where an attacker can position themselves as a man-in-the-middle; conversely, users on trusted corporate networks face lower practical exposure. The combination of unauthenticated network vector and high impact on a widely deployed VPN endpoint client makes this a priority patch despite the UI requirement.

A user opens their laptop on hotel Wi-Fi and launches the Ivanti Secure Access Client to connect to corporate VPN. An attacker on the same network intercepts the TLS handshake with a forged certificate that the client fails to properly validate, then delivers a malicious payload through the established 'trusted' tunnel that executes as arbitrary code on the endpoint. No public exploit identified at time of analysis, but the attack pattern is well-understood for CWE-295 flaws in VPN clients.