CVE-2026-8051Disclosure(ivanti / virtual_traffic_manager)

MEDIUMCVSS 7.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch ivanti virtual_traffic_manager systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

ivanti CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2026-8051?language=en_US

Weakness type (CWE)

CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

virtual_traffic_manager

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-05-12); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

ivanti

Products

virtual_traffic_manager

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

Disclosure

133.3%

Patch

133.3%

Active Exploitation

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-12	1	Disclosure1
2026-05-14	1	Patch1
2026-08-18	1	Active Exploitation1

Full discourse3 posts

CCB Alert@CCBalert148d
Patch
Warning: Multiple critical and high vulnerabilities in #Ivanti #EndpointManager #EPM #VirtualTrafficManager #VTM #Xtraction #CVE-2026-8043 #CVE-2026-8051 #CVE-2026-8111 #CVE-2026-8110 CVSS: 9.6.-7.2 For details visit our advisory https://ccb.belgium.be/advisories/warning-ivanti-has-released-security-updates-address-vulnerabilities-affecting-several #Patch #Patch #Patch
Post summary
An advisory warns about multiple high‑severity CVEs in Ivanti products, cites CVSS scores, and directs users to a patch advisory.
02010247
7.2K followersView on X
iototsecnews@iototsecnews52d
Active Exploitation
WordPress の脆弱性 CVE-N/A：汚染された API レスポンスによるサプライチェーン攻撃 https://iototsecnews.jp/2026/08/10/new-wordpress-supply-chain-attack-compromises-themes-via-poisoned-api-response/ 開発元サードパーティのデータ配信拠点が侵害され、不適切なデータ処理に起因する脆弱性が悪用されました。対象の製品は BdThemes 製の Element Pack Addons for Elementor や Prime Slider Addons for Elementor といった WordPress 用プラグイン群です。サードパーティ側バケットの汚染により、外部からの動的コンテンツ取得時における出力エスケープ不足という脆弱性 (CVE-2026-8051 / CVE 未採番) が突かれ、管理者の閲覧時に悪意の JavaScript が作動します。これにより不正アカウント追加／Web シェル設置／バックドア形成などの甚大な権限奪取被害へ繋がります。対処として推奨されるのは、不審な管理者ユーザーの点検／追加ファイルの点検／データベース内の不正レコード削除／セキュリティ診断ツールの活用などです。 #SupplyChain #Vulnerability #WordPress
Post summary
The post reports an active supply‑chain attack against WordPress plugins (CVE‑2026‑8051), wherein an output‑escaping flaw in a poisoned API response allowed malicious JavaScript to run on administrative pages, and it advises administrators to examine user accounts, files, and database records for remediation.
00010158
507 followersView on X
Kaitan ID Security@KaitanSecurity149d
Disclosure
⚠️ HIGH — CVE-2026-8051 OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker wit… CVSS 7.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-8051 #Ivanti #CyberSecurity #InfoSec
Post summary
The post announces CVE-2026-8051, an OS command injection flaw in Ivanti Virtual Traffic Manager with a CVSS score of 7.2, but does not provide PoC code, exploit details, or active exploitation evidence. It serves primarily as a disclosure of the vulnerability.
0000064
90 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ivanti	virtual_traffic_manager	-	-	-
App	ivanti	virtual_traffic_manager	22.9	-	-
App	ivanti	virtual_traffic_manager	22.9	-	-
App	ivanti	virtual_traffic_manager	22.9	-	-

Explore more

Back to dashboard ivanti CVEs virtual_traffic_manager vulnerabilities

What researchers are saying

CVE-2026-8051

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post announces CVE-2026-8051, an OS command injection flaw in Ivanti Virtual Traffic Manager with a CVSS score of 7.2, but does not provide PoC code, exploit details, or active exploitation evidence. It serves primarily as a disclosure of the vulnerability.

CCB Alert@CCBalertPatch

An advisory warns about multiple high‑severity CVEs in Ivanti products, cites CVSS scores, and directs users to a patch advisory.

iototsecnews@iototsecnewsActive Exploitation

The post reports an active supply‑chain attack against WordPress plugins (CVE‑2026‑8051), wherein an output‑escaping flaw in a poisoned API response allowed malicious JavaScript to run on administrative pages, and it advises administrators to examine user accounts, files, and database records for remediation.