An improper certificate validation flaw in Ivanti Secure Access Client allows a remote unauthenticated attacker to execute arbitrary code. The vulnerability exists when the client accepts a server certificate without performing proper validation, enabling an attacker to supply a forged certificate and control the client’s execution flow. The flaw targets the trust‑anchor handling mechanism (CWE-295) and can lead to complete compromise of the machine where the client runs.

Ivanti Secure Access Client versions earlier than 22.8R6 are affected. These versions are distributed under the Ivanti brand and use the Secure Access Client product for remote connectivity.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS value means the exploitation probability is uncertain. The vulnerability is remote and does not require authentication, allowing attackers to reach systems that use the client over the network. Because the flaw permits arbitrary code execution, the confidentiality, integrity, and availability of the connected systems are all at risk. The vulnerability is not currently listed in CISA’s KEV catalog. An attacker could exploit the flaw by establishing an SSL/TLS connection to a malicious server presenting a forged certificate that passes the client’s flawed validation routine, thereby triggering code execution on the client side.