CISA warns of critical IXON VPN Client flaw in versions before 1.4.7

CISA has published an advisory on a critical vulnerability in IXON VPN Client, identifying CVE-2026-75925 in versions before 1.4.7.

The agency said successful exploitation could allow remote code execution on the computer running the client with elevated privileges. CISA rated the flaw critical, with a CVSS v3.1 base score of 9.6, and said the issue is tied to improper neutralization of CRLF sequences.

Why it matters

CISA said the vulnerability could let an attacker execute commands as root or SYSTEM, which can give an intruder deep access to the affected machine. The advisory also said the injected configuration can persist across restarts of the client and operating system, while the VPN connection continues to work normally.

CISA listed the product as IXON VPN Client from vendor IXON and marked it as known affected. The agency said the deployment is worldwide and noted critical infrastructure sectors that include Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater.

Context and background

According to the advisory, the flaw involves configuration values accepted by a local service and written to a file later used by a privileged subprocess. CISA said line-ending sequences are not neutralized, which can let an attacker introduce additional directives into the file.

The advisory also cited a contributing weakness: the configuration interface accepts changes without authenticating or verifying the requester's origin. CISA gave the issue a CVSS v4.0 base score of 9.4 and also labeled it critical.

The agency said the initial release date was 2026-08-05 and that the advisory was republished on 2026-09-03. CISA also said no known public exploitation specifically targeting the vulnerability had been reported to it at the time of publication.

What officials said

CISA wrote in the advisory: “Successful exploitation of this vulnerability could allow an attacker to perform remote code execution.”

The acknowledgment section said Luuk van Rheden of IXON discovered the vulnerability and Stan van Duijnhoven of IXON reported it to CISA.

What happens next

CISA and IXON said users should update IXON VPN Client to version 1.4.7 or later on every computer where it is installed. The advisory also said IXON cloud rejects connections from clients below v1.4.7 at both the portal and back-end API as of 2026-08-05.

CISA also said users should uninstall the VPN client if it is no longer needed. The agency advises minimizing network exposure for control system devices and keeping remote access tools updated.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.