Ivanti Secure Access Client pre-22.8R6 certificate validation flaw (CVE-2026-8992)
CVE-2026-8992 Published on May 22, 2026

An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.

NVD

Vulnerability Analysis

CVE-2026-8992 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.


Products Associated with CVE-2026-8992

Want to know whenever a new CVE is published for Ivanti Secure Access Client? stack.watch will email you.

Ivanti Secure Access Client
 

Affected Versions

ivanti Secure Access Client Version 22.8R6 is unaffected by CVE-2026-8992