CVE-2025-22454

CVE-2025-22454 concerns Ivanti Secure Access Client (ISAC). Affected: ISAC before 22.7R4 (Windows) with insufficiently restrictive permissions that allow a local, authenticated attacker to escalate privileges. Root cause: privilege limitation flaw enabling unauthorized elevation. Impact: local pr...

CVE-2023-35080

CVE-2023-35080 affects Ivanti Secure Access Client for Windows. The public material in connected documents confirms a vulnerable configuration enabling a locally authenticated attacker to achieve elevation of privileges, denial of service, or information disclosure. A GitHub exploit linked to thi...

CVE-2023-38041

CVE-2023-38041 affects Ivanti Secure Access Client prior to 22.6R1. A local unprivileged user can elevate privileges via a TOCTOU race in a specific process flow, enabling unauthorized elevated access on the system. The Ivanti forum entry provides a remediation: upgrade to version 22.6R1. The CVS...

CVE-2023-38042

CVE-2023-38042; Ivanti Secure Access Client for Windows suffers a local privilege escalation (low privilege user becomes SYSTEM). Root cause described in PT-2024-4024 as a memory buffer overflow; other sources corroborate LPE on Windows. No patch/version details are provided in the supplied docum...

CVE-2024-29211

CVE-2024-29211 is a race condition in Ivanti Secure Access Client prior to 22.7R4. A local authenticated attacker can modify sensitive configuration files due to synchronization issues when accessing shared resources. Affected product: Ivanti Secure Access Client (Windows/Linux/macOS). Impact sta...

CVE-2024-8539

CVE-2024-8539 : Ivanti Secure Access Client is affected by improper authorization that allows a local authenticated attacker to modify sensitive configuration files. Affected software: Ivanti Secure Access Client prior to version 22.7R3. Impact: local privilege via manipulation of configuration f...

CVE-2024-13813

CVE-2024-13813 concerns Ivanti Secure Access Client. The vulnerability is due to insufficient permissions in ISAC prior to version 22.8R1, allowing a local authenticated attacker to delete arbitrary files. Affected software: Ivanti Secure Access Client (ISAC) before 22.8R1. Impact: local file del...

CVE-2024-7571

CVE-2024-7571 concerns Ivanti Secure Access Client (Windows) before 22.7R4. It arises from incorrect permissions that allow a local authenticated attacker to escalate privileges. Affected versions: ISAC before 22.7R4. Remediation: upgrade to 22.7R4 or later (per Ivanti advisories). Related entrie...

CVE-2024-9842

CVE-2024-9842 refers to an improper permissions issue in Ivanti Secure Access Client, before version 22.7R4, that allows a local authenticated attacker to create arbitrary folders. Multiple connected advisories corroborate the detail of an attacker with local access exploiting incorrect permissio...

CVE-2024-38654

CVE-2024-38654 affects Ivanti Secure Access Client prior to version 22.7R3. The issue is due to improper bounds checking (a buffer copy without size validation), which can be exploited by a local authenticated attacker with admin privileges to cause a denial of service. The coordinated remediatio...

CVE-2023-46810

Ivanti CVE-2023-46810 affects the Ivanti Secure Access Client for Linux prior to 22.7R1. The issue is a local privilege escalation (low-privileged user to root) tied to a buffer overflow in the Linux client component. Impact is local, with root-equivalent code execution possible if exploited. Rem...

CVE-2024-37398

CVE-2024-37398 relates to Ivanti Secure Access Client. The issue is caused by insufficient input validation in the client before version 22.7R4, enabling a local authenticated attacker to escalate privileges (local, initial access via the client). The CVE is also observed in related Ivanti produc...

CVE-2024-9843

CVE-2024-9843 is a buffer over-read in Ivanti Secure Access Client prior to 22.7R4 that allows a local unauthenticated attacker to cause a denial of service. Connected sources confirm the issue affects Ivanti Secure Access Client and note the vulnerability is addressed by upgrading to version 22....

CVE-2023-38043

CVE-2023-38043 affects Ivanti Secure Access Client prior to 22.6R1.1. A locally authenticated attacker could exploit a vulnerable configuration to cause a DoS on the user machine and, in some cases, fully compromise the system. Documents also indicate similar issues for CVE-2023-35080 and CVE-202...

CVE-2023-38543

The CVE-2023-38543 entry affects Ivanti Secure Access Client versions prior to 22.6R1.1. The vulnerability is triggered by a vulnerable configuration on systems with local authentication, potentially causing a DoS on the user machine. Public sources confirm the affected version range and suggest ...