CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Ivanti Secure Access Client

product · product:ivanti-secure-access-client

Coverage
1
first 2026-05-14 → last 2026-10-21
Latest activity
2026-05-14
Ivanti's May 2026 batch fixes an authenticated Xtraction file-read and HTML-write flaw (CVSS 9.6), no…
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector
Sources cited
6
4 hosts

Defender insights

What each entry about Ivanti Secure Access Client tells a defender to do, newest first.

2026-05-14ROUTINEIvanti's May 2026 batch fixes an authenticated Xtraction file-read and HTML-write flaw (CVSS 9.6), no exploitation known

Exposure · detection

Story timeline

  1. 2026-05-14CVE-2026-8043, Ivanti Xtraction: authenticated file read and HTML write (CVSS 9.6), patched with an Endpoint Manager SQL injection to RCE and a Virtual Traffic Manager admin command injection in Ivanti's May 2026 batch
    trending-vulnerabilitiesIvanti's May 2026 batch fixes an authenticated Xtraction file-read and HTML-write flaw (CVSS 9.6), no exploitation known

Hunting pivots

CVEs
CVE-2026-8043CVE-2026-8051CVE-2026-8111
Releases covered
Ivanti Secure Access Client
Tags
info-disclosurepatch-availablercesqlivulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-14/cve-2026-8043-ivanti-xtraction-external-file-control-cvss-9 · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-05-14/cve-2026-8043-ivanti-xtraction-external-file-control-cvss-9 · ATT&CK page ↗

Entries about Ivanti Secure Access Client (1)

2026-05-14 · view entry permalink →

ROUTINECVE-2026-8043 +2updatedNATOA2

CVE-2026-8043, Ivanti Xtraction: authenticated file read and HTML write (CVSS 9.6), patched with an Endpoint Manager SQL injection to RCE and a Virtual Traffic Manager admin command injection in Ivanti's May 2026 batch

Ivanti's May 2026 security update of 2026-05-12 discloses vulnerabilities in Secure Access Client, Xtraction, Virtual Traffic Manager and Endpoint Manager (EPM), and Ivanti says it has no evidence of any of them being exploited in the wild (Ivanti, 2026-05-12); SecurityWeek counts seven flaws across the four advisories (SecurityWeek, 2026-05-13). The most severe, CVE-2026-8043, is external control of a file name in Xtraction before version 2026.2 that lets a remote authenticated attacker read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks; Ivanti scores it 9.6, with low privileges required and a changed scope (ENISA EUVD, 2026-05-12).

The batch also fixes CVE-2026-8111, an SQL injection in the EPM web console before 2024 SU6 that lets a remote authenticated attacker achieve remote code execution, scored 8.8 (ENISA EUVD, 2026-05-12), and CVE-2026-8051, an OS command injection in Virtual Traffic Manager before 22.9r4 that lets a remote authenticated attacker with admin privileges achieve remote code execution, scored 7.2 (ENISA EUVD, 2026-05-12). CERT-FR lists the affected versions as EPM before 2024 SU6, Secure Access Client before 22.8R6, Virtual Traffic Manager before 22.9r4 and Xtraction before 2026.2 (CERT-FR, 2026-05-13).

We have no evidence of these vulnerabilities being exploited in the wild.

Ivanti 2026-05-12

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

ENISA EUVD (EUVD-2026-29487) 2026-05-12

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

ENISA EUVD (EUVD-2026-29491) 2026-05-12

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

ENISA EUVD (EUVD-2026-29488) 2026-05-12
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevent_dateevidenceheadlineprioritysourcessourcing_notesummarytagstechniquestitle

CVE-2026-8043 lets a remote authenticated attacker read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks (ENISA EUVD, 2026-05-12); it is not a remote code execution flaw, and no source describes a route from the HTML write to a web shell. Endpoint Manager is affected before 2024 SU6 and fixed in 2024 SU6 (ENISA EUVD, 2026-05-12; CERT-FR, 2026-05-13). Ivanti says it has no evidence of these vulnerabilities being exploited in the wild (Ivanti, 2026-05-12).

With no evidence of exploitation in the wild (Ivanti, 2026-05-12), the batch is a regular-cycle patch. The batch also covered Secure Access Client, fixed in 22.8R6 (CERT-FR, 2026-05-13).

vulnerability14 May 05:00Zmulti-sourceOpen finding →
Sources: Ivanti · CERT-FR · SecurityWeek · ENISA EUVD (EUVD-2026-29487) · ENISA EUVD (EUVD-2026-29491) · ENISA EUVD (EUVD-2026-29488)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu3 (50%)
  • cert.ssi.gouv.fr1 (17%)
  • ivanti.com1 (17%)
  • securityweek.com1 (17%)
All cited sources (6)