CVE-2025-22454

CVE-2025-22454 concerns Ivanti Secure Access Client (ISAC). Affected: ISAC before 22.7R4 (Windows) with insufficiently restrictive permissions that allow a local, authenticated attacker to escalate privileges. Root cause: privilege limitation flaw enabling unauthorized elevation. Impact: local pr...

CVE-2026-8992

The CVE-2026-8992 entry concerns Ivanti Secure Access Client, vulnerable prior to version 22.8R6, due to improper certificate validation. The issue allows remote unauthenticated attackers to execute arbitrary code. According to the description and CVSS metrics (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2023-34298

CVE-2023-34298 affects Pulse Secure Client via the SetupService directory traversal flaw. The issue stems from inadequate validation of a user-supplied path before file operations, allowing a local attacker who can run low-privilege code to escalate privileges and potentially execute arbitrary co...

CVE-2023-38041

CVE-2023-38041 affects Ivanti Secure Access Client prior to 22.6R1. A local unprivileged user can elevate privileges via a TOCTOU race in a specific process flow, enabling unauthorized elevated access on the system. The Ivanti forum entry provides a remediation: upgrade to version 22.6R1. The CVS...

CVE-2023-35080

CVE-2023-35080 affects Ivanti Secure Access Client for Windows. The public material in connected documents confirms a vulnerable configuration enabling a locally authenticated attacker to achieve elevation of privileges, denial of service, or information disclosure. A GitHub exploit linked to thi...

CVE-2023-38042

CVE-2023-38042; Ivanti Secure Access Client for Windows suffers a local privilege escalation (low privilege user becomes SYSTEM). Root cause described in PT-2024-4024 as a memory buffer overflow; other sources corroborate LPE on Windows. No patch/version details are provided in the supplied docum...

CVE-2024-29211

CVE-2024-29211 is a race condition in Ivanti Secure Access Client prior to 22.7R4. A local authenticated attacker can modify sensitive configuration files due to synchronization issues when accessing shared resources. Affected product: Ivanti Secure Access Client (Windows/Linux/macOS). Impact sta...

CVE-2024-13813

CVE-2024-13813 concerns Ivanti Secure Access Client. The vulnerability is due to insufficient permissions in ISAC prior to version 22.8R1, allowing a local authenticated attacker to delete arbitrary files. Affected software: Ivanti Secure Access Client (ISAC) before 22.8R1. Impact: local file del...

CVE-2024-8539

CVE-2024-8539 : Ivanti Secure Access Client is affected by improper authorization that allows a local authenticated attacker to modify sensitive configuration files. Affected software: Ivanti Secure Access Client prior to version 22.7R3. Impact: local privilege via manipulation of configuration f...

CVE-2024-7571

CVE-2024-7571 concerns Ivanti Secure Access Client (Windows) before 22.7R4. It arises from incorrect permissions that allow a local authenticated attacker to escalate privileges. Affected versions: ISAC before 22.7R4. Remediation: upgrade to 22.7R4 or later (per Ivanti advisories). Related entrie...

CVE-2024-9842

CVE-2024-9842 refers to an improper permissions issue in Ivanti Secure Access Client, before version 22.7R4, that allows a local authenticated attacker to create arbitrary folders. Multiple connected advisories corroborate the detail of an attacker with local access exploiting incorrect permissio...

CVE-2024-38654

CVE-2024-38654 affects Ivanti Secure Access Client prior to version 22.7R3. The issue is due to improper bounds checking (a buffer copy without size validation), which can be exploited by a local authenticated attacker with admin privileges to cause a denial of service. The coordinated remediatio...

CVE-2024-9843

CVE-2024-9843 is a buffer over-read in Ivanti Secure Access Client prior to 22.7R4 that allows a local unauthenticated attacker to cause a denial of service. Connected sources confirm the issue affects Ivanti Secure Access Client and note the vulnerability is addressed by upgrading to version 22....

CVE-2023-46810

Ivanti CVE-2023-46810 affects the Ivanti Secure Access Client for Linux prior to 22.7R1. The issue is a local privilege escalation (low-privileged user to root) tied to a buffer overflow in the Linux client component. Impact is local, with root-equivalent code execution possible if exploited. Rem...

CVE-2024-37398

CVE-2024-37398 relates to Ivanti Secure Access Client. The issue is caused by insufficient input validation in the client before version 22.7R4, enabling a local authenticated attacker to escalate privileges (local, initial access via the client). The CVE is also observed in related Ivanti produc...

CVE-2023-38544

CVE-2023-38544 affects Ivanti (Secure Access Client) on Linux. A logged-in user can modify specific files, potentially enabling unauthorized changes to system-wide configuration settings, compromising integrity. Root cause: exploitation locally by a user with low privileges; impact listed as part...

CVE-2023-41718

Ivanti Secure Access Client vulnerable to local privilege escalation (CVE-2023-41718) when a user has control over a specific file. Affected products are Ivanti Secure Access Client versions prior to 22.6R1. The underlying issue is a local privilege escalation vulnerability in the Windows client....

CVE-2023-38043

CVE-2023-38043 affects Ivanti Secure Access Client prior to 22.6R1.1. A locally authenticated attacker could exploit a vulnerable configuration to cause a DoS on the user machine and, in some cases, fully compromise the system. Documents also indicate similar issues for CVE-2023-35080 and CVE-202...

CVE-2023-38543

The CVE-2023-38543 entry affects Ivanti Secure Access Client versions prior to 22.6R1.1. The vulnerability is triggered by a vulnerable configuration on systems with local authentication, potentially causing a DoS on the user machine. Public sources confirm the affected version range and suggest ...

CVE-2026-7432

Ivanti Secure Access Client (before 22.8R6) is affected by two adjacent CVEs identified in the connected documents. CVE-2026-7432 describes a race condition that could allow a locally authenticated user to escalate privileges to SYSTEM. CVE-2026-7431 describes an incorrect permission assignment f...

CVE-2026-7431

Affected product: Ivanti Secure Access Client. Vulnerabilities (pre-22.8R6): 7431 involves an incorrect permission assignment on a critical resource, enabling a local authenticated user to read/modify sensitive log data via write access to a shared memory section. 7432 is a race condition that al...