IXON VPN Client
IXON VPN Client vulnerability allows remote code execution with elevated privileges.
A critical vulnerability (CVE-2026-75925) has been identified in IXON VPN Client versions prior to 1.4.7. Successful exploitation could allow an attacker to execute commands as root or SYSTEM on the affected client. IXON recommends updating to version 1.4.7 or later, and as a mitigation, IXON cloud will reject connections from unpatched clients.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IXON?
Get an email when a new story names IXON, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in IXON VPN Client versions prior to 1.4.7 allows attackers to execute arbitrary commands with root or SYSTEM-level privileges, representing a full system compromise of any affected endpoint. The flaw highlights the dangers of running unpatched VPN client software, which sits at a highly privileged and trusted position in the network stack. Because VPN clients often run with elevated system privileges and handle sensitive network traffic, they are high-value targets for attackers seeking persistent, deep access. IXON's decision to reject connections from unpatched clients at the cloud level is a notable server-side mitigation, but organizations must not rely solely on vendor-enforced controls and should patch proactively.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-75925