CVE-2026-8051

Published: May 12, 2026Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected (4)

Products: Ivanti: Virtual Traffic Manager

Ivanti

1 product

Virtual Traffic Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ivanti Virtual Traffic Manager	Up to 22.8
Ivanti Virtual Traffic Manager	Version 22.9 r1
Ivanti Virtual Traffic Manager	Version 22.9 r2
Ivanti Virtual Traffic Manager	Version 22.9 r3

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

Timeline

No history available yet.