CISA has republished an advisory warning that a critical vulnerability in the IXON VPN Client could let an attacker execute code remotely with elevated privileges on a computer running the software. The Sept. 3 republication covers CVE-2026-75925, which affects IXON VPN Client versions before 1.4.7. CISA’s advisory assigns the flaw a CVSS 3.1 score of 9.6 and a CVSS 4.0 score of 9.4, both in the critical range.

The vulnerability is an improper neutralization of CRLF sequences, classified as CWE-93. CISA says the client’s local service accepts configuration changes without authenticating the requester or verifying the request’s origin. Those values are written to a file later consumed by a privileged subprocess. By introducing additional directives into that file, an attacker could cause commands to run as root on Linux systems or SYSTEM on Windows systems.

The advisory’s CVSS 3.1 vector describes the flaw as network reachable, requiring low attack complexity, no privileges, and user interaction. The listed impact includes high effects on confidentiality, integrity, and availability. CISA’s summary says successful exploitation could enable remote code execution on the computer running the client with elevated privileges.

The attack can leave little visible evidence to the user. CISA says the injected configuration remains on disk through restarts of both the client and the operating system, while the VPN connection continues to function normally. The absence of an obvious change in the VPN’s behavior could make the compromise more difficult to notice during ordinary use. CISA does not report known public exploitation specifically targeting CVE-2026-75925.

IXON recommends upgrading every installed VPN Client to version 1.4.7 or later. The company also recommends uninstalling the client from computers where it is no longer needed. Organizations using the software should identify each computer on which it is installed and apply the update across those systems rather than treating the VPN connection itself as evidence that the client is current.

A server-side control has also been in place since Aug. 5, according to the CISA notice. IXON cloud rejects connections from clients older than version 1.4.7 at both the portal and the back-end API. CISA says the privileged subprocess and injected listener are created only when the client connects, so an unpatched installation cannot complete the exploit chain after that connection block is applied. Updating remains the recommended action, and removing the client is an option where it is no longer required.

The affected software is associated with remote access to environments in commercial facilities, critical manufacturing, energy, information technology, and water and wastewater. CISA lists deployment as worldwide and identifies IXON’s headquarters location as the Netherlands. The advisory credits Luuk van Rheden of IXON with discovering the vulnerability and Stan van Duijnhoven of IXON with reporting it to CISA.

CISA advises organizations to minimize internet exposure for control-system devices and place control-system networks and remote devices behind firewalls, separated from business networks. The agency recommends using secure remote-access methods while recognizing that VPN security also depends on the connected devices and that VPN software must be kept current.

CISA also urges organizations to assess the operational impact of defensive changes before deploying them. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation. The agency further recommends caution with unsolicited email links and attachments as part of broader defenses against social-engineering attacks.

The advisory was initially issued Aug. 5 and was marked as initially republished on Sept. 3. The republication keeps attention on a vulnerability in software used to provide remote connectivity to operational and business environments, while the available mitigations focus on upgrading or removing affected clients and restricting connections from versions below 1.4.7.