EUVD-2026-31445
GHSA-748c-m6r6-qw5q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
AnalysisAI
Remote code execution in Ivanti Secure Access Client versions prior to 22.8R6 allows unauthenticated attackers to run arbitrary code on endpoints by exploiting improper TLS certificate validation, contingent on user interaction (UI:R). No public exploit identified at time of analysis, but the CVSS 8.8 rating and Ivanti's own advisory disclosure mark this as a high-priority client-side risk for organizations using the VPN client.
Technical ContextAI
The flaw is rooted in CWE-295 (Improper Certificate Validation), a class of weakness where TLS/SSL trust chains are not fully verified - common failure modes include skipping hostname checks, accepting self-signed certs, or failing to validate the issuer chain. Ivanti Secure Access Client is the endpoint VPN agent (formerly Pulse Secure Client) that establishes encrypted tunnels to Ivanti Connect Secure / Policy Secure gateways. When certificate validation is broken in such a client, a network-positioned attacker can impersonate the legitimate gateway and inject malicious responses that the client trusts. The affected CPE is cpe:2.3:a:ivanti:secure_access_client across all versions before 22.8R6.
RemediationAI
Upgrade Ivanti Secure Access Client to version 22.8R6 or later - this is the vendor-released patch identified in the input data. Consult Ivanti's May 2026 advisory at https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Secure-Access-Client-CVE-2026-7431-CVE-2026-7432 for the full patched-version matrix and confirm coverage of CVE-2026-8992 specifically. As a compensating control until patching completes, instruct users to avoid initiating VPN sessions from untrusted networks (public Wi-Fi, hotels) and enforce always-on VPN policies that pin gateway endpoints; this reduces the MitM opportunity but does not eliminate it. Network-level controls such as requiring connections only from managed networks via NAC can further limit exposure at the cost of remote-work flexibility.
More in Secure Access Client
View allDHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an at
Local privilege escalation vulnerability in Citrix Secure Access Client for Windows that allows an authenticated, low-pr
Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate t
Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate the
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the aff
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally au
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally au
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticate
A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an a
Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to d
Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to mod
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today