Ivanti Secure Access Client
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-8992 | fixed in 22.8R6 | An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to ex | HIGH 8.8 | 0.6 % | ||
| CVE-2026-7432 | fixed in 22.8R6 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM | HIGH 7.8 | 0.3 % | ||
| CVE-2026-7431 | fixed in 22.8R6 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to | MEDIUM 4.4 | 0.2 % | ||
| CVE-2025-22454 | fixed in 22.7R4, 22.8R1 | Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their | HIGH 7.8 | 0.3 % | ||
| CVE-2024-13813 | fixed in 22.8R1 | Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary file | HIGH 7.1 | 0.2 % | ||
| CVE-2024-38654 | 22.7R3 – < 22.7R3 | Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to | MEDIUM 4.4 | 0.3 % | ||
| CVE-2024-37398 | 22.7R4 – < 22.7R4 | Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. | HIGH 7.8 | 0.3 % | ||
| CVE-2024-29211 | 22.7R4 – < 22.7R4 | A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratio | HIGH 7.1 | 0.3 % | ||
| CVE-2024-7571 | fixed in 22.7R4 | Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. | HIGH 7.8 | 0.3 % | ||
| CVE-2024-9843 | fixed in 22.7R4 | A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-9842 | fixed in 22.7R4 | Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders | HIGH 7.3 | 0.2 % | ||
| CVE-2024-8539 | fixed in 22.7R3 | Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive config | HIGH 7.1 | 0.2 % | ||
| CVE-2023-38042 | 22.7R1 – < 22.7R1 | A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM | HIGH 7.8 | 0.3 % | ||
| CVE-2023-35080 | 22.6.1.1 – < 22.6.1.1 | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi | HIGH 8.8 | 0.7 % | ||
| CVE-2023-38041 | 22.6R1 – < 22.6R1 | A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process fl | HIGH 7.8 | 0.7 % |