Advisories › IXON › ICSA-26-246-02
IXON VPN Client: 1 CVE, Critical 9.6
Summary
CISA reports 1 vulnerability in IXON VPN Client. Weakness type: Improper Neutralization of CRLF Sequences ('CRLF Injection'). Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges. Highest CVSS v3 score: 9.6 (Critical), exploitable over the network.
What to do: Act now: IXON recommends updating the IXON VPN client to version 1.4.7 or later on every computer where it is installed.
Why this matters for oil & gas: IXON VPN clients are used for remote access to PLCs and HMIs.
At a glance
- Vendor
- IXON
- Products
- VPN Client
- CVEs
- CVE-2026-75925
- Highest CVSS v3
- 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Energy, Information Technology, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- Netherlands
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-75925 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 9.6 | – | No | Improper Neutralization of CRLF Sequences (CWE-93) in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralised, which allows additional directives to be introduced into that file. The configuration … |
Affected products (1)
- IXON VPN Client: <1.4.7
Vendor fixes and mitigations (from advisory)
- Mitigation: IXON recommends updating the IXON VPN client to version 1.4.7 or later on every computer where it is installed.
- Mitigation: As of August 5, 2026, IXON cloud rejects connections from clients below v1.4.7 at both the portal and the back-end API. Since the privileged subprocess and injected listener are only created when the client connects, unpatched installations cannot complete the exploit chain.
- Mitigation: If the client is no longer needed, IXON recommends uninstalling the VPN client from the computer.
- Mitigation: For more information please refer to the IXON Trust Center Advisory at https://www.ixon.cloud/Advisories/ADV-2026-08-05.pdf. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.