# CVE-2026-7432: Ivanti Secure Access Client race condition privilege escalation

Source: https://junglewise.ai/threats/cve-2026-7432-ivanti-secure-access-client-race-condition-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-7432 · Severity: high · CVSS 7.8 · Published 2026-05-12

A vulnerability in the Ivanti Secure Access Client, a tool used for secure remote connectivity, could allow a user already logged into a Windows computer to gain full administrative (SYSTEM) control. This type of flaw is typically used by attackers who have already gained a foothold on a machine to deepen their access and disable security protections. Organizations should update the client software to version 22.8R6 or later to prevent this privilege escalation.

Technologies: [Ivanti Secure Access Client](https://junglewise.ai/threats/technologies/secure-access-client). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-7432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7432 being exploited in the wild.

**How severe is CVE-2026-7432?** High severity, with a CVSS score of 7.8, published 12 May 2026.

**Which products and versions are affected?** Ivanti Secure Access Client before 22.8R6.

**Is there a fix for CVE-2026-7432?** A patch was published on 2026-05-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7432 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-7432?** Check whether you run Ivanti Secure Access Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition (CWE-362) exists in the Ivanti Secure Access Client for Windows prior to version 22.8R6. The vulnerability occurs during concurrent execution using shared resources with improper synchronization, allowing a locally authenticated attacker with low privileges to exploit a timing window to execute code with SYSTEM-level authority. The attack requires local access to the target machine but no user interaction. Ivanti has released version 22.8R6 to address this issue.

## Affected products

- Ivanti Secure Access Client before 22.8R6

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched

## References

- [https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Secure-Access-Client-CVE-2026-7431-CVE-2026-7432?language=en_US](https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Secure-Access-Client-CVE-2026-7431-CVE-2026-7432?language=en_US)

## Related threats

- [Ivanti Secure Access Client improper certificate validation](https://junglewise.ai/threats/cve-2026-8992-ivanti-secure-access-client-improper-certificate-validation)
- [Ivanti Secure Access Client incorrect permission assignment in shared memory](https://junglewise.ai/threats/cve-2026-7431-ivanti-secure-access-client-incorrect-permission-assignment-in)