CVE-2026-8992: Ivanti Secure Access Client RCE Flaw

CVE-2026-8992 Overview

CVE-2026-8992 is an improper certificate validation vulnerability [CWE-295] in Ivanti Secure Access Client versions before 22.8R6. The flaw allows a remote unauthenticated attacker to execute arbitrary code on affected Windows endpoints when a user interacts with the client. Because certificate validation is bypassed, an attacker positioned on the network can impersonate a trusted server and deliver malicious payloads to the VPN client process.

Critical Impact
A network-positioned attacker can execute arbitrary code on endpoints running Ivanti Secure Access Client when a user initiates a connection, leading to full endpoint compromise.

Affected Products

Ivanti Secure Access Client versions prior to 22.8R6
Ivanti Secure Access Client 22.8, 22.8R1, 22.8R2, 22.8R3, 22.8R4, and 22.8R5
Microsoft Windows hosts running the affected client

Discovery Timeline

2026-05-22 - CVE-2026-8992 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-8992

Vulnerability Analysis

The vulnerability resides in how Ivanti Secure Access Client validates the server certificate presented during VPN session establishment. The client fails to properly verify the certificate chain, allowing an attacker to present a forged or untrusted certificate that the client accepts as valid. Once the client trusts the malicious endpoint, the attacker can deliver crafted server responses that lead to arbitrary code execution in the context of the client process.

This class of weakness [CWE-295] is particularly dangerous in VPN software because the client is designed to establish a privileged tunnel and process server-supplied configuration data. Successful exploitation requires user interaction, typically initiating a VPN connection, but does not require authentication or prior access to the target. Confidentiality, integrity, and availability are all affected at the endpoint level.

Root Cause

The root cause is missing or incomplete validation of the X.509 certificate chain presented by the server endpoint during TLS handshake. The client does not enforce strict trust anchors, hostname verification, or revocation checks, enabling an attacker with a self-signed or attacker-controlled certificate to be accepted.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker who can intercept or redirect VPN client traffic, through DNS poisoning, ARP spoofing on a hostile network, or a malicious Wi-Fi access point, can present a forged server certificate. When the user initiates a connection to what appears to be a trusted gateway, the client accepts the forged certificate and processes attacker-controlled server data, triggering code execution.

No verified public proof-of-concept is available at this time. See the Ivanti Security Advisory May 2026 for vendor technical details.

Detection Methods for CVE-2026-8992

Indicators of Compromise

Unexpected VPN connection attempts from Ivanti Secure Access Client to non-corporate IP addresses or hostnames.
TLS handshakes from the client involving self-signed certificates or certificates issued by untrusted certificate authorities.
New or unexpected child processes spawned by the Ivanti Secure Access Client process on Windows endpoints.
Outbound traffic from the client process to attacker-controlled infrastructure following a connection attempt on an untrusted network.

Detection Strategies

Inspect TLS sessions originating from the Ivanti client and alert on certificates that do not chain to the approved corporate certificate authority.
Monitor endpoint process trees for anomalous executions parented by the Ivanti Secure Access Client binary.
Correlate VPN connection logs with the destination gateway addresses defined in approved client configurations.

Monitoring Recommendations

Forward client and gateway logs to a centralized analytics platform for correlation with network telemetry.
Alert on Ivanti Secure Access Client connections initiated from public or untrusted networks where the presented certificate fingerprint deviates from known good values.
Track client version inventory and flag endpoints running any version prior to 22.8R6.

How to Mitigate CVE-2026-8992

Immediate Actions Required

Upgrade Ivanti Secure Access Client to version 22.8R6 or later on all Windows endpoints.
Inventory endpoints to identify any installations of vulnerable versions 22.8 through 22.8R5.
Restrict VPN client usage to managed, trusted networks until patching is complete.

Patch Information

Ivanti has released a fixed version in 22.8R6. Refer to the Ivanti Security Advisory May 2026 for official remediation guidance and downloads.

Workarounds

Instruct users to avoid initiating VPN connections from untrusted networks such as public Wi-Fi until the client is upgraded.
Enforce strict egress filtering so that the Ivanti client can only reach approved corporate gateway addresses.
Deploy certificate pinning or network-level inspection where supported to detect anomalous certificate presentations.

bash

# Verify installed Ivanti Secure Access Client version on Windows
wmic product where "Name like 'Ivanti Secure Access Client%'" get Name,Version

# After upgrade, confirm the version is 22.8R6 or later