Secure Access Client (Ivanti) - vulnerabilities (CVEs)

21 CVEs, 0 in the last 30 days, 28 known versions, newest CVE from 2026-05-22. Vendor: Ivanti.

CVEs of Secure Access Client

• CVE-2026-8992 - CVSS 8.8 (high), 2026-05-22: An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary…
• CVE-2026-7432 - CVSS 7.8 (high), 2026-05-12: A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
• CVE-2026-7431 - CVSS 4.4 (medium), 2026-05-12: An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local authenticated user to read or modify…
• CVE-2025-22454 - CVSS 7.8 (high), 2025-03-11: Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
• CVE-2024-13813 - CVSS 7.1 (high), 2025-02-11: Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files.
• CVE-2024-38654 - CVSS 4.4 (medium), 2024-11-13: Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of…
• CVE-2024-37398 - CVSS 7.8 (high), 2024-11-13: Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
• CVE-2024-29211 - CVSS 7.1 (high), 2024-11-13: A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files.
• CVE-2024-9843 - CVSS 5.5 (medium), 2024-11-12: A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.
• CVE-2024-9842 - CVSS 7.3 (high), 2024-11-12: Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.
• CVE-2024-8539 - CVSS 7.1 (high), 2024-11-12: Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.
• CVE-2024-7571 - CVSS 7.8 (high), 2024-11-12: Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
• CVE-2023-38042 - CVSS 7.8 (high), 2024-05-31: A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM.
• CVE-2023-46810 - CVSS 7.3 (high), 2024-05-31: A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute code as root.
• CVE-2023-34298 - CVSS 7.8 (high), 2024-05-03: Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate…
• CVE-2023-41718 - CVSS 7.8 (high), 2023-11-15: When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over…
• CVE-2023-38544 - CVSS 5.5 (medium), 2023-11-15: A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited…
• CVE-2023-38543 - CVSS 8.8 (high), 2023-11-15: A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a…
• CVE-2023-38043 - CVSS 8.8 (high), 2023-11-15: A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a…
• CVE-2023-35080 - CVSS 8.8 (high), 2023-11-15: A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable…
• CVE-2023-38041 - CVSS 7.8 (high), 2023-10-25: A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated,…