Critical Flaw in IXON VPN Client Allows Commands to Run as root or SYSTEM

A vulnerability in the IXON VPN Client could allow commands to run with the highest privileges on an affected computer. Tracked as CVE-2026-75925, the flaw affects all versions of IXON VPN Client prior to 1.4.7.

CISA has rated the issue as critical. It received a score of 9.6 out of 10 under CVSS 3.1 and 9.4 under CVSS 4.0. The attack combines two dangerous weaknesses: configurations are accepted without verifying the requester, and data is written without properly neutralizing end-of-line sequences.

The result can be the insertion of new directives into a file later processed by a privileged subprocess. The injected commands are then executed as root or SYSTEM, depending on the operating environment.

All Versions Prior to 1.4.7 Are Vulnerable

The affected product is IXON VPN Client, which is used for remote access to distributed systems and infrastructure. IXON is based in the Netherlands, but the software is distributed worldwide.

A fix is available in version 1.4.7. Accordingly, all releases with a lower version number are considered vulnerable:

• Product: IXON VPN Client
• Vulnerable versions: all versions prior to 1.4.7
• Fixed version: 1.4.7 or later
• Identifier: CVE-2026-75925
• Primary classification: CWE-93, improper neutralization of CRLF sequences
• Related condition: CWE-306, missing authentication for a critical function

The vulnerability was discovered by Luuk van Rheden of IXON. The report to CISA was submitted by Stan van Duijnhoven, also from the company.

The initial advisory was published on August 5, 2026. CISA republished it in a second revision on September 3, 2026.

How CRLF Injection Leads to Privileged Code Execution

CRLF sequences, commonly represented as \r\n, delimit lines in various text-based formats. If an application writes attacker-controlled values to a file without filtering these characters, an attacker can terminate the intended line and add additional ones.

In IXON VPN Client, the target is the local mechanism that handles configuration. Values received by the service are written to a file that is subsequently read by a highly privileged subprocess.

The application does not adequately neutralize end-of-line characters. A value apparently intended for a single field can therefore become multiple lines, including directives the program should not have accepted.

However, the flaw is not limited to incorrect handling of CRLF sequences. The configuration interface allows changes without authenticating the requester or verifying its origin. This second weakness further lowers the barriers to exploitation.

The attack chain can be summarized as follows:

1. the attacker prepares a configuration value containing end-of-line sequences;
2. the service accepts the change without adequate authentication;
3. the value is written to the configuration file;
4. the new lines become independent directives;
5. a privileged subprocess processes the file;
6. the injected commands run as root or SYSTEM.

The file path involved, the exact names of exploitable directives, and a public proof of concept have not been disclosed.

Low-Complexity Attack with User Interaction Required

The CVSS 3.1 vector assigned to the vulnerability is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

The rating indicates that the attack can be carried out over a network, has low complexity, and requires no prior privileges. User interaction is nevertheless required. The CVSS 4.0 vector, which assigns a score of 9.4, expresses the same condition as passive interaction:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The precise nature of the required interaction has not been detailed. Based on the published information, it is therefore not possible to determine what action the victim must take during an attempted compromise.

The potential impact remains high across all three primary security properties: confidentiality, integrity, and availability. Privileged execution could allow an attacker to read or alter data, install additional components, and disrupt the computer’s operation.

The scope change indicated by the CVSS vector also points to possible consequences for components outside the security boundary initially breached.

Malicious Configuration Survives Reboots

One of the most concerning aspects of CVE-2026-75925 is persistence. The injected configuration is stored on disk and may remain active after the VPN client or the entire operating system is restarted.

At the same time, the VPN connection may continue to operate normally. Users might therefore see no interruption, obvious errors, or noticeable changes in their experience.

This combination makes the compromise more difficult to detect: the legitimate component remains operational while the added directives continue to be processed by the privileged process.

No specific indicators of compromise have been published, such as file names, hashes, IP addresses, or strings to search for. Administrators can nevertheless check for unexpected changes to client configurations by comparing them with trusted copies and centrally managed configurations.

Organizations should also review events related to the launch of privileged processes, particularly when the executed programs are inconsistent with the VPN’s normal functions. In the absence of official paths and signatures, these checks should be adapted to the local environment.

No Known Public Exploitation and No KEV Deadline Listed

At the time of the advisory, CISA had not received reports of known public exploitation specifically targeting CVE-2026-75925. This distinguishes the critical vulnerability from an incident already documented in the wild, but it does not lessen the need to update.

The flaw has not been listed in CISA’s Known Exploited Vulnerabilities, or KEV, catalog. No inclusion date or federal remediation deadline has therefore been associated with this vulnerability.

The distinction is operationally relevant: the KEV catalog tracks vulnerabilities for which evidence of real-world exploitation exists. In this case, the available information describes a high-impact vulnerability that is relatively easy to exploit, but without publicly confirmed campaigns.

Potentially affected sectors include critical manufacturing, energy, information technology, water, and wastewater, as well as commercial facilities. In industrial environments, compromise of an endpoint used for remote access could also provide a foothold into connected systems.

Update Immediately and Check Persistent Configurations

The top priority is to update IXON VPN Client to version 1.4.7 or later. Deployment of the patch should be verified through centralized asset inventory rather than relying solely on the update status reported by users.

After upgrading, organizations should inspect configurations already stored on disk. Fixing the software does not necessarily remove malicious directives that may have been inserted before the update.

Organizations should also:

• identify all endpoints running IXON VPN Client;
• isolate or immediately update versions prior to 1.4.7;
• review configurations, persistence mechanisms, and processes launched with elevated privileges;
• avoid directly exposing control systems to the Internet;
• separate industrial and corporate networks using firewalls and segmentation;
• reassess remote-access methods and the privileges granted to VPN endpoints;
• apply defense-in-depth measures to ICS assets;
• initiate internal incident-response procedures if unauthorized changes are detected.

CISA also references ICS-TIP-12-146-01B — Targeted Cyber Intrusion Detection and Mitigation Strategies for detecting and mitigating targeted intrusions. Because the attack requires user interaction, defenses against phishing and social engineering remain relevant: unsolicited links and attachments should be treated as potential initial attack vectors.