EUVD-2026-31445
GHSA-748c-m6r6-qw5q
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
AnalysisAI
Remote code execution in Ivanti Secure Access Client versions prior to 22.8R6 allows unauthenticated attackers to run arbitrary code on endpoints by exploiting improper TLS certificate validation, contingent on user interaction (UI:R). No public exploit identified at time of analysis, but the CVSS 8.8 rating and Ivanti's own advisory disclosure mark this as a high-priority client-side risk for organizations using the VPN client.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Inventory Ivanti Secure Access Client deployments across all endpoints and document installed versions; brief executive and operational teams on risk; implement endpoint-level monitoring and alerting. 7 days: Contact Ivanti for 22.8R6 release timeline; begin EDR deployment or enhancement on affected systems; restrict VPN usage to essential business functions where operationally feasible. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today