Secure Access Client EUVD-2026-29486

Exploitation requires the attacker to already hold a locally authenticated, low-privileged session on a system running Ivanti Secure Access Client prior to version 22.8R6 (AV:L, PR:L) - there is no remote or unauthenticated path. The flaw is a race condition (CWE-362), and the high attack complexity (AC:H) means the attacker must reliably win a timing window, which limits dependable exploitation; the exact operation that must be raced is not described in the available sources. No user interaction is required (UI:N). Limiting factors: local access prerequisite, existing authentication, and timing-dependent exploitation; patching to 22.8R6 is the vendor-stated fix.

This is a genuinely moderate, not urgent, privilege-escalation issue. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a local, high-complexity flaw that requires the attacker to already be a locally authenticated user (PR:L) and offers total technical impact (escalation to SYSTEM). All exploitation signals point away from imminent widespread attacks: EPSS is 0.03% (8th percentile), SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit is identified. These low-exploitation signals are consistent with each other and with the high attack complexity (AC:H) and local-only vector - nothing here is internet-reachable or self-propagating. The vuln.today decision label is 'this_week', reflecting the total technical impact (SYSTEM compromise) rather than active exploitation, so patch within the normal prioritized cycle rather than treating it as an emergency. The high-complexity race condition (CWE-362) further limits reliable exploitation. Net: a legitimate local EoP worth patching on a prompt-but-routine schedule, not a high-CVSS/low-real-risk false alarm, but also not an actively-exploited priority.

An attacker who already has a low-privileged authenticated session on a machine running Ivanti Secure Access Client (e.g., a standard domain user or malware running in user context) repeatedly triggers the vulnerable operation to win a timing race in the client, elevating their code to SYSTEM. Because the flaw is AC:H and local, exploitation requires an existing foothold and reliable race-window timing. No public exploit is identified at time of analysis.