This vulnerability (CVE-2026-8051) affects Ivanti Virtual Traffic Manager prior to version 22.9r4 and is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). It enables a remote attacker who has authenticated with administrative privileges to perform OS command injection, resulting in remote code execution. The CVSS v3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability with network attack vector, low attack complexity, and no user interaction required. The vendor has not yet provided an official fix or remediation details, and the product is not a cloud service, so remediation depends on vendor patching. No public exploits are known.

Successful exploitation allows a remote attacker with admin privileges to execute arbitrary OS commands on the affected system, leading to complete compromise of the system's confidentiality, integrity, and availability. This can result in unauthorized access, data theft, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to command execution. Do not assume the vulnerability is mitigated without vendor confirmation.