CISA’s ICSA-26-246-02 advisory covers a critical vulnerability in the IXON VPN Client that could allow an attacker to execute commands with root or SYSTEM privileges on the computer running the client. The flaw, tracked as CVE-2026-75925, affects IXON VPN Client versions earlier than 1.4.7 and carries a CVSS v3.1 score of 9.6. CISA identifies the vulnerability as improper neutralization of CRLF sequences, or CWE-93, with missing authentication on the configuration interface contributing to the attack path. The affected software is deployed worldwide across sectors including commercial facilities, critical manufacturing, energy, information technology, and water and wastewater. 

The technical weakness is particularly interesting because it converts what should be ordinary configuration data into privileged command execution. Configuration values supplied to the IXON VPN Client are written into a file that is later consumed by a privileged subprocess. Because carriage-return and line-feed sequences are not adequately neutralized, an attacker can insert additional configuration directives into that file. When the privileged subprocess subsequently processes the modified configuration, those injected directives can result in commands being executed as root on Unix-like platforms or SYSTEM on Windows. The configuration interface also accepts changes without properly authenticating or verifying the origin of the requester, which substantially increases the practical severity of the issue.

This is a useful example of why input-validation vulnerabilities can become much more serious when they cross a privilege boundary. CRLF injection is often associated with comparatively limited issues such as HTTP header manipulation or log injection. In CVE-2026-75925, however, the injected line endings alter a configuration file that is subsequently trusted by a highly privileged process. The dangerous element is therefore not simply that the attacker can insert another line. It is that the receiving process interprets that attacker-controlled line with significantly greater privileges than the attacker possesses.

The vulnerability also illustrates a classic confused-deputy problem. The attacker does not necessarily execute a privileged command directly. Instead, they manipulate data consumed by a trusted system component and persuade that component to perform the privileged operation on their behalf. This class of vulnerability is especially dangerous in VPN clients, endpoint agents and management utilities because those products frequently require elevated privileges to configure network interfaces, routes, certificates, firewall rules and tunnel components. Once attacker-controlled input reaches that privileged execution path, the legitimate security software can effectively become part of the exploit chain.

Another concerning characteristic is persistence. CISA’s vulnerability description states that the injected configuration persists on disk across both client and operating-system restarts. Even more importantly, normal VPN connectivity can continue functioning, meaning the victim may not see any obvious operational change indicating that the configuration has been manipulated.

That stealth factor matters in OT environments. Engineers and maintenance personnel often use remote-access clients because they need reliable connectivity to industrial systems. If the VPN continues functioning normally, there may be little reason for the user to suspect compromise. The attacker could potentially retain a privileged foothold while the remote-access workflow appears completely legitimate. Security incidents involving tools that visibly break are inconvenient, but they are also easier to notice. A vulnerability that preserves normal functionality while adding hidden privileged behaviour is considerably more useful to an attacker.

The location of the vulnerable software also makes CVE-2026-75925 strategically important. OT cybersecurity discussions tend to concentrate on vulnerabilities in PLCs, HMIs, industrial gateways and protocol stacks. But remote-access software on an engineer’s workstation can occupy an equally sensitive position. Such a machine may connect both to enterprise infrastructure and to operational technology networks, making it a natural bridge between environments that organizations otherwise attempt to segment carefully.

If an attacker gains SYSTEM or root privileges on an engineering workstation, the consequences may therefore extend beyond that endpoint. Depending on the user’s role and network architecture, the compromised machine may contain VPN credentials, browser sessions, configuration files, engineering software, certificates or access to industrial devices. It may also already be authorized through firewalls or access-control systems to communicate with OT networks that would normally reject connections originating elsewhere.

This is why remote-access clients should be treated as part of the OT security boundary rather than merely as convenience software installed on user machines. A vulnerability in the client can undermine controls that appear secure at the network level because the compromised system is already trusted to cross those boundaries.

The CVSS vector is also revealing. CISA rates the vulnerability as network reachable, low complexity and requiring no privileges, although user interaction is required. The precise method used to deliver malicious configuration input will therefore matter operationally, but the absence of authentication on the configuration interface means an attacker does not need legitimate IXON credentials before attempting exploitation.

Organizations should not interpret the user-interaction requirement as a reason to downgrade the issue substantially. Many successful attacks already depend on persuading users to visit a website, open a document or perform another apparently routine action. When the resulting execution occurs with root or SYSTEM privileges, relatively modest user interaction can still produce severe consequences.

IXON has addressed the vulnerability in VPN Client version 1.4.7, and CISA recommends upgrading every installation to version 1.4.7 or later. IXON has also implemented a useful server-side compensating control: since August 5, 2026, IXON Cloud rejects connections from clients older than version 1.4.7 through both the portal and backend API. Because the privileged subprocess and injected listener are created when the client connects, preventing vulnerable clients from completing a cloud connection blocks completion of the known exploit chain against the IXON Cloud service.

That vendor-side action is particularly noteworthy. Security fixes normally depend on every customer finding and patching every vulnerable endpoint. By refusing connections from unsafe versions, IXON has introduced an additional control at the service layer that reduces the opportunity for vulnerable clients to remain silently operational for months or years. It also means that organizations still running older versions may experience connectivity problems until they upgrade, but in this context that is preferable to allowing a known critical client to continue operating indefinitely.

However, the cloud-side restriction should not be interpreted as a substitute for patching. The vulnerable software remains installed locally, and organizations should remove or update it regardless of whether IXON Cloud currently blocks the exploit chain. CISA also recommends uninstalling the VPN client entirely from machines where it is no longer required.

For defenders, inventory is therefore the first priority. Organizations should identify every workstation, engineering laptop, jump host and support machine running the IXON VPN Client and verify the actual installed version. This is particularly important for laptops used by field engineers or external contractors, which may not participate consistently in centralized patch-management systems. Remote-access tools often survive on machines long after the original project or support requirement has ended.

Security teams should also consider whether configuration files associated with older IXON VPN installations have been unexpectedly modified. Because the malicious directives can persist on disk, simply updating the client may not answer the forensic question of whether manipulation occurred previously. Where compromise is suspected, defenders should preserve configuration files and system logs before remediation and examine them for unauthorized directives or unusual changes.

At present, CISA states that it is not aware of public exploitation specifically targeting CVE-2026-75925. That is an important distinction: this is a critical vulnerability requiring prompt remediation, but there is currently no basis to describe it as an actively exploited campaign. Organizations should nevertheless patch before public exploit development turns that distinction into an historical footnote.

The vulnerability should also prompt organizations to review how much privilege remote-access software receives. VPN clients typically require elevated capabilities, but the surrounding architecture can still minimize exposure. Administrative access to configuration interfaces should be restricted, software installation should be centrally controlled, and local security policies should prevent ordinary applications from modifying privileged VPN configuration wherever technically possible.

Endpoint detection can provide another layer of protection. Security teams should monitor for unusual child processes spawned by privileged VPN services, unexpected command shells running as SYSTEM or root, modifications to VPN configuration files outside normal update windows, and new listeners or processes appearing shortly after VPN client activity. These behaviours may provide useful evidence even when the vulnerability itself leaves little visible indication to the user.

The incident also reinforces the value of separating OT remote-access workstations from normal browsing and email activity. An engineer’s laptop capable of establishing privileged connectivity into an industrial environment should ideally not have the same exposure profile as an ordinary corporate endpoint. The more email, web browsing and general-purpose applications permitted on that system, the more opportunities an attacker has to reach privileged remote-access software through an unrelated initial compromise.

Organizations using jump servers or privileged access workstations for OT connectivity can reduce this risk considerably. If remote industrial access originates only from hardened systems with tightly controlled software, limited internet connectivity and strong monitoring, vulnerabilities in individual client applications become harder to exploit from arbitrary external content.

CVE-2026-75925 ultimately exposes an architectural lesson that applies well beyond IXON.

VPN software sits at a particularly sensitive intersection.

It runs with elevated operating-system privileges because it has to manipulate networking components, and it exists specifically to connect systems across security boundaries.

That combination makes it a valuable security control when it works correctly, but an unusually powerful attack surface when it does not.

The affected product is called a VPN client, but defenders should think of it as a privileged network-management agent.

Once viewed that way, a configuration injection flaw leading to SYSTEM or root execution stops looking like an ordinary desktop vulnerability and starts looking exactly as serious as its 9.6 CVSS score suggests.

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges. The following versions of IXON VPN Client are affected: VPN Client <1.4.7 (CVE-2026-75925) CVSS Vendor Equipment Vulnerabilities v3 9.6 IXON IXON VPN Client Improper Neutralization of CRLF Sequences ('CRLF Injection') Background Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Energy, Information Technology, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Netherlands Vulnerabilities Expand All + CVE-2026-75925 Improper Neutralization of CRLF Sequences (CWE-93) in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralised, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester (CWE-306, contributing). The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user. View CVE Details Affected Products IXON VPN Client Vendor: IXON Product Version: IXON VPN Client: <1.4.7 Prod

Source: IXON VPN Client via CISA Advisories — published 03 Sep 2026.