# CVE-2026-8051: Ivanti Virtual Traffic Manager OS command injection

Source: https://junglewise.ai/threats/cve-2026-8051-ivanti-virtual-traffic-manager-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-8051 · Severity: high · CVSS 7.2 · Published 2026-05-12

Ivanti Virtual Traffic Manager, a solution used to manage and optimize application traffic, is vulnerable to a security flaw that allows an administrator to execute unauthorized commands on the underlying system. If exploited, an attacker with administrative credentials could take full control of the appliance, potentially leading to data theft or service disruption. This issue is resolved in version 22.9r4 and later.

Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-8051 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8051 being exploited in the wild.

**How severe is CVE-2026-8051?** High severity, with a CVSS score of 7.2, published 12 May 2026.

**Which products and versions are affected?** Ivanti Virtual Traffic Manager before 22.9r4.

**Is there a fix for CVE-2026-8051?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8051 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8051?** Check whether you run Ivanti Virtual Traffic Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the Ivanti Virtual Traffic Manager (vTM) management interface. The flaw is caused by improper neutralization of special elements used in OS commands within the appliance's administrative components. A remote attacker with high privileges (admin) can exploit this vulnerability over the network without user interaction to execute arbitrary code with the privileges of the underlying operating system. Ivanti has released version 22.9r4 to address this vulnerability.

## Affected products

- Ivanti Virtual Traffic Manager (vTM) before 22.9r4

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory

## References

- [https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US](https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US)

## Related threats

- [Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-7593-ivanti-virtual-traffic-manager-authentication-bypass-vulnerability)