CVE-2025-8310

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-12 · updated 2026-06-17
Weakness: CWE-862

Description

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password

Affected products

Ivanti Virtual Application Delivery ControllerCWE-862: before 22.9 — fixed in 22.9

How to fix

Upgrade to a fixed version: Ivanti Virtual Application Delivery ControllerCWE-862 22.9. Check the vendor advisory for mitigations.

References

https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Virtual-Application-Delivery-Controller-vADC-previously-vTM-CVE-2025-8310?language=en_US

Get alerted when CVE-2025-8310 or the next vulnerability affects your stack