CISA has warned that a critical vulnerability in the IXON VPN Client could let an attacker execute commands with elevated privileges on a computer running the software. The agency republished its advisory on September 3, updating an initial August 5 publication, according to CISA.
The flaw, tracked as CVE-2026-75925, affects IXON VPN Client versions before 1.4.7. CISA assigned it a CVSS v3.1 score of 9.6, placing it in the critical category. The advisory also lists a CVSS v4.0 score of 9.4. Successful exploitation could allow remote code execution on the computer running the client, including commands executed as root or SYSTEM.
The vulnerability involves improper handling of carriage-return and line-feed sequences, commonly called CRLF injection. Configuration values accepted by a local service are written to a file that a privileged subprocess later consumes. Because line-ending sequences are not neutralized, an attacker can introduce additional directives into that file.
The service also accepts configuration changes without authenticating the requester or verifying where the request originated. That lack of authentication contributes to the attack path. The injected configuration persists on disk through restarts of the VPN client and the operating system. The VPN connection can continue working normally, so a user may not see an obvious change after the configuration is altered.
CISA describes the vulnerability as affecting software deployed worldwide and identifies potential use in commercial facilities, critical manufacturing, energy, information technology, and water and wastewater environments. IXON is headquartered in the Netherlands. The advisory identifies Luuk van Rheden of IXON as the vulnerability’s discoverer and Stan van Duijnhoven of IXON as the person who reported it to CISA.
IXON recommends installing version 1.4.7 or later on every computer where the client is present. It also recommends uninstalling the client from systems where it is no longer needed. CISA’s notice says IXON cloud has rejected connections from clients below version 1.4.7 at both its portal and back-end API since August 5.
The connection controls are relevant to the exploitation process. CISA says the privileged subprocess and injected listener are created only when the client connects. As a result, an unpatched installation cannot complete the exploit chain when it cannot establish the required connection through those controls. Updating the client remains the recommended remediation for computers where the software is installed.
CISA said it had no report of public exploitation specifically targeting CVE-2026-75925 at the time of the advisory. It recommends limiting network exposure for control-system devices and systems, placing control networks and remote devices behind firewalls, and isolating them from business networks. When remote access is required, CISA recommends more secure methods while stressing that VPNs should be updated and are only as secure as the connected devices.
The agency also advises organizations to conduct an impact analysis and risk assessment before applying defensive changes. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation with other incidents. CISA separately recommends caution with unsolicited email links and attachments as part of its guidance on social engineering risks.