High · 7.2 CVE-2026-8051 EUVD-2026-29488GHSA-3rm6-879f-q3r2

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges t…

Published May 12, 2026 · Updated May 13, 2026 · Assigned by ivanti

Vendor: ivanti Product: Virtual Traffic Manager Category: Network devices

Description

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected products

Vendor	Product	Affected	Fixed
ivanti	Virtual Traffic Manager	—	22.9r4

References

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US