CVE-2026-8051
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Published May 12, 2026 · updated Jun 17, 2026 · ivanti virtual traffic manager
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 12, 2026 · NIST NVD
Detected
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Jun 17, 2026 · NIST NVD
Updated
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected
- cpe ivanti/virtual traffic managerversion unspecified
- cpe ivanti/virtual traffic manager22.9
Sources
- CVE.orgVulnerability recordCVE-2026-8051
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-8051
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
nvd.nist.gov