Medium · 6.5 CVE-2025-8310 EUVD-2025-24260GHSA-9582-7xgq-xhq8

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authentica…

Published Aug 12, 2025 · Updated Feb 26, 2026 · Assigned by ivanti

Vendor: ivanti Product: Virtual Application Delivery ControllerCWE-862 Category: Network devices

Description

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password

Affected products

Vendor	Product	Affected	Fixed
Ivanti	Virtual Application Delivery ControllerCWE-862	—	22.9

References

https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Virtual-Application-Delivery-Controller-vADC-previously-vTM-CVE-2025-8310?language=en_US