This vulnerability (CVE-2026-8992) in Ivanti Secure Access Client is due to improper certificate validation (CWE-295). It affects versions before 22.8R6 and allows a remote attacker without authentication to execute arbitrary code. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability loss. No patch or official remediation level has been disclosed by Ivanti as of the publication date.

Successful exploitation can lead to arbitrary code execution by a remote unauthenticated attacker, compromising confidentiality, integrity, and availability of the affected system. This could allow full control over the client device running Ivanti Secure Access Client versions prior to 22.8R6.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted networks or certificates and monitor Ivanti's advisories for updates. No official workaround or temporary fix has been provided by the vendor.