The vulnerability arises from an incorrect permission assignment for a critical resource in Ivanti Secure Access Client prior to version 22.8R6. A local authenticated user can obtain write access to a shared memory section and thereby read or modify sensitive log data, compromising the confidentiality and integrity of logs. This is a CWE‑732 issue and does not provide a path to remote execution or privilege escalation beyond the local user.

Ibanti Secure Access Client versions older than 22.8R6 are affected. Users running the client on a host with local authentication are at risk.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score is not available, so the exploitation probability remains uncertain. The vulnerability is not listed in the CISA KEV catalog, and the attack vector requires local authentication; an attacker with a valid user account can manipulate the shared memory section. The risk is limited to users who already have local access, though compromising log data may facilitate further attacks.