This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) within Ivanti Virtual Traffic Manager prior to version 22.9r4. An attacker who is authenticated with admin-level privileges can exploit this flaw to perform remote code execution by injecting malicious OS commands. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution with administrative privileges, potentially leading to full system compromise, data disclosure, modification, or denial of service. The impact is high given the level of access required and the scope of control gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for suspicious activity related to command execution. Avoid exposing the management interface to untrusted networks.