VulnSocial

CVE-2026-75925Disclosure

MEDIUMCVSS 9.4 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-93

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 6 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-08); latest day: 1
  • 6 total mentions across 5 days

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-09-03: 1Mentions · 2026-09-04: 1Mentions · 2026-09-05: 1Mentions · 2026-09-08: 2Mentions · 2026-09-12: 1Active Exploitation · 2026-09-04: 1Patch / Workaround · 2026-09-05: 1Patch / Workaround · 2026-09-08: 2Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 1Technical Details · 2026-09-05: 1Technical Details · 2026-09-08: 2Technical Details · 2026-09-12: 109-0309-0409-0509-0809-12
Signal classification3 categories
Disclosure
350.0%
Patch
233.3%
Active Exploitation
116.7%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-031
Disclosure1
2026-09-041
Active Exploitation1
2026-09-051
Patch1
2026-09-082
Disclosure1Patch1
2026-09-121
Disclosure1
Full discourse6 posts
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Kritische CVE-2026-75925 in IXON VPN Client: Root-Ausführung über CRLF-Injection #crlfinjection #cve202675925 #ixonvpnclient https://cybersecurity-news.de/cve-2026-75925-ixon-vpn-client-crlf-injection-root

    Post summary

    The tweet announces a critical CVE‑2026‑75925 in IXON VPN Client that allows root execution via CRLF injection, but it provides no PoC, exploit code, patch, or active exploitation details.

    0000054
    12 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-75925: CRLF injection in IXON VPN Client (<1.4.7) lets unauthenticated attackers execute commands as root/SYSTEM via crafted config values. CVSS 9.6. Unpatched—assume risk now. Update immediately if using this client. https://www.valtersit.com/cve/CVE-2026-75925 #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali

    Post summary

    A high‑severity CRLF injection flaw in IXON VPN Client enables unauthenticated remote code execution as root; users are advised to patch immediately.

    0000076
    1.0K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-75925: CRLF injection in IXON VPN Client (<1.4.7) lets unauthenticated attackers execute commands as root/SYSTEM via crafted config values. CVSS 9.6. Unpatched—assume risk now. Update immediately if using this client. https://www.valtersit.com/cve/CVE-2026-75925/ #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali

    Post summary

    The tweet announces a high‑severity CRLF injection flaw in IXON VPN Client that allows unauthenticated command execution as root; it stresses that the client is unpatched and urges users to update immediately.

    0000086
    1.0K followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-75925 (CVSS 9.6) in IXON VPN Client &lt;1.4.7 allows root/SYSTEM command execution. Update to 1.4.7+ if deployed. https://nvd.nist.gov/vuln/detail/CVE-2026-75925 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/aMsarRx28C

    Post summary

    The notice signals a high‑severity vulnerability (CVE‑2026‑75925) in IXON VPN Client that permits root‑level execution and advises users to update to version 1.4.7 or newer.

    0000038
    93 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploited CVE-2026-75925 in IXON VPN clients to achieve SYSTEM/root privileges through CRLF injection attacks. The vulnerability allowed remote code execution by manipulating configuration files processed by privileged subprocesses. Runtime segmentation helps limit blast radius when VPN infrastructure becomes compromised. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/ixon-vpn-client-cve-2026-75925-crlf-injection-2026

    Post summary

    The text reports that attackers have actively exploited CVE-2026-75925 in IXON VPN clients via CRLF injection to gain root privileges, with no mention of patches, PoC, or mitigation.

    0000049
    2.0K followersView on X
  • NewsTongue@NewsTongueX
    Disclosure

    🔴 IXON VPN Client Remote Code Execution Flaw Affects Critical Infrastructure IXON VPN Client versions below 1.4.7 contain an improper CRLF sequence neutralization vulnerability (CVE-2026-75925) that allows unauthenticated local attackers to execute commands with root or SYSTEM privileges. The flaw exploits a configuration interface that accepts changes without verifying the requester's identity. Injected commands persist across client and OS restarts with no visible behavioral change to users.

    Post summary

    The post announces a local remote code execution flaw (CVE‑2026‑75925) in IXON VPN Client versions below 1.4.7, allowing unauthenticated local attackers to run arbitrary commands with root or SYSTEM privileges via an improperly neutralised CRLF sequence.

    0000063
    851 followersView on X

Explore more

Back to dashboard