CVE-2026-8110

Ivanti has released security updates to fix vulnerabilities that affect several of its products. CVE-2026-8111 involves and SQL injection vulnerability in the  web console component of Ivanti Endpoint Manager versions prior to 2024 SU6, with CVSS sore of 8.8. This vulnerability could allow a remote attacker to achieve remote code execution. CVE-2026-8110 is an incorrect permission assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6, with a CVSS score of 7.8. An authenticated local attacker could leverage this misconfiguration to escalate their privileges and achieve full control over the affected systems. CVE-2026-8043 addresses a critical severity vulnerability affecting Ivanti Xtraction before version 2026.2, with a CVSS score of 9.6. The vulnerability involves external control of a file name, which allows a remote authenticated attacker to read files and write arbitrary HTML files to a web directory. This results in information disclosure and may facilitate client-side attacks against users accessing the affected web content. CVE-2026-8051 affects Ivanti Traffic Manager versions prior to 22.9r4; it addresses a high-severity vulnerability with a CVSS score of 7.2. This vulnerability could allow a remote attacker who has authenticated with admin privileges to perform OS command injection, resulting in remote code execution. CVE-2026-7432 involves race condition in Ivanti Secure Access Client prior to version 22.8R6, which addresses a high severity vulnerability, with a CVSS score of 7.8. A race condition occurs when concurrent execution using shared resources is not properly synchronized, which in this case could allow a locally authenticated attacker to escalate privileges to SYSTEM level.

EPSS 0.03% · 7.8th percentile