Quick answers
- Is CVE-2026-8992 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8992 being exploited in the wild.
- How severe is CVE-2026-8992?
- High severity, with a CVSS score of 8.8, published 22 May 2026.
- Which products and versions are affected?
- Ivanti Secure Access Client before 22.8R6.
- Is there a fix for CVE-2026-8992?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8992 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-8992?
- Check whether you run Ivanti Secure Access Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper certificate validation vulnerability (CWE-295) exists in the Ivanti Secure Access Client on Windows. The root cause is a failure to correctly validate the identity of server-side certificates during the connection process. A remote, unauthenticated attacker can exploit this by intercepting or redirecting network traffic to a malicious server. Successful exploitation requires minimal user interaction (UI:R) and can result in remote code execution (RCE) with high impact on confidentiality, integrity, and availability. Ivanti has released version 22.8R6 to address this issue.
Affected products
- Ivanti Secure Access Client before 22.8R6
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory: Ivanti released security advisory and patch information