This vulnerability (CVE-2026-7431) affects Ivanti Secure Access Client versions prior to 22.8R6. It is caused by incorrect permission assignment (CWE-732) on a critical resource, specifically a shared memory section used for logging. A local authenticated user can exploit this to gain write access to sensitive log data, potentially leading to unauthorized information modification or disclosure. The CVSS 3.1 base score is 4.4, reflecting low confidentiality and integrity impact without availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

A local authenticated attacker can read or modify sensitive log data due to improper permissions on a shared memory section. This could lead to unauthorized disclosure or tampering with log information, potentially affecting forensic or operational integrity. There is no indication of impact on system availability. The vulnerability requires local access and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to trusted individuals only and monitor for unusual local activity related to the Ivanti Secure Access Client. Avoid granting unnecessary local privileges to users on affected systems.