CVE-2026-8051: OS Command Injection
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Virtual Traffic Managerto a version that resolves this vulnerability.Fixed in 22.9r4 - Compensating control
Limit Virtual Traffic Manager administrative access to trusted networks/users only, since the issue requires a remote authenticated attacker with admin privileges to achieve remote code execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8051?
CVE-2026-8051 has a high severity rating as it allows remote code execution for authenticated admin users.
How do I fix CVE-2026-8051?
To fix CVE-2026-8051, upgrade Ivanti Virtual Traffic Manager to version 22.9r4 or later.
Who is affected by CVE-2026-8051?
CVE-2026-8051 affects users of Ivanti Virtual Traffic Manager versions prior to 22.9r4.
What is the impact of CVE-2026-8051?
The impact of CVE-2026-8051 includes the potential for attackers to execute arbitrary commands on the affected systems.
Is authentication required to exploit CVE-2026-8051?
Yes, CVE-2026-8051 requires an attacker to be an authenticated admin user to exploit the vulnerability.