An OS command injection flaw exists in Ivanti Virtual Traffic Manager versions before 22.9r4, enabling a remote authenticated attacker who holds administrative privileges to execute arbitrary system commands. The vulnerability, classified as CWE‑78, can lead to full control over the host, compromising confidentiality, integrity, and availability of the managed network infrastructure.

Ivanti Virtual Traffic Manager is affected for all releases older than version 22.9r4. Systems running these unpatched versions are at risk when administrators log in and issue management commands that are improperly sanitized.

The flaw carries a CVSS score of 7.2, indicating high severity. While the EPSS score is not available, the absence of a fix in the CISA KEV catalog suggests exploitation is not widely reported yet, but the requirement of admin authentication means only privileged users can initiate an attack. An attacker would exploit the command injection by sending crafted input through the administration interface, causing the vulnerable system to interpret and execute the injected commands end‑to‑end.