Ivanti Secure Access Client: Local Privilege Escalation via Race Condition (CVE-2026-7432)

The National Vulnerability Database has disclosed CVE-2026-7432, a high-severity race condition vulnerability affecting Ivanti Secure Access Client versions prior to 22.8R6. This flaw, rated 7.8 CVSS, allows a locally authenticated user to escalate privileges to SYSTEM.

This isn’t just a theoretical bug. Race conditions are tricky to exploit reliably, but when they hit SYSTEM-level privileges, they become a prime target for post-exploitation. An attacker who has already gained initial access to a system can leverage this to consolidate their foothold, move laterally, and exfiltrate data with far less resistance. It’s a classic privilege escalation vector, and Ivanti clients are often found on critical endpoints.

Defenders need to understand the attacker’s calculus here: achieving local admin or SYSTEM is a major win. This vulnerability provides exactly that. Patching is non-negotiable, and organizations should prioritize this update immediately to close off a critical path for adversaries to deepen their control.