CVE-2026-8051

HIGH

Ivanti Virtual Traffic Manager - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: rule

Description

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

References (1)

Core 1

Core References

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US

Scores

CVSS v3 7.2

EPSS 0.0146

EPSS Percentile 81.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (3)

ivanti/Virtual Traffic Manager 22.9r4

ivanti/virtual_traffic_manager 22.9 r1 (3 CPE variants)

ivanti/virtual_traffic_manager < 22.8

Published May 12, 2026

Tracked Since May 12, 2026