CVE-2026-75925: Improper neutralization of CRLF sequences in IXON VPN Client before vulnerability

What happened

CVE-2026-75925: Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configurat. A security weakness in Improper neutralization of CRLF sequences in IXON VPN Client before is being tracked as CVE-2026-75925. CVE-2026-75925 currently carries a CRITICAL 9 6 severity signal in the retained vulnerability data.

Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes wit. The issue currently carries a CRITICAL 9 6 severity signal in the CyberDeltaForce record.

The operational question is not simply the severity score, but whether the affected component is deployed, reachable, business-critical and protected by compensating controls. If you use the affected technology, first check whether the vulnerable component is actually present and reachable. The current severity assessment is CRITICAL 9 6.

Real risk depends on exposure, exploitability, compensating controls and the importance of the affected asset—not the CVSS number alone. Exposure — Required condition: Improper neutralization of CRLF sequences in IXON VPN Client before is present and the vulnerable function is reachable in the way the software is normally used. Security outcome — Not publicly disclosed in enough detail to state a specific post-exploitation result without inference.

The story is primarily about a software weakness. Risk depends on whether the affected product and versions are present, whether the vulnerable function is reachable, whether exploitation is public or active, and what privileges the affected process carries. Initial trigger — Required condition: attacker-controlled input or the relevant workflow reaches the affected code path.

The issue is tracked as CVE-2026-75925. The current record lists the severity as CRITICAL 9.6. The current record does not mark the vulnerability as actively exploited.

NIST NVD published the primary report used for this article on Sep 7, 2026. Defender interruption point — Map Improper neutralization of CRLF sequences in IXON VPN Client before to real assets, verify the vendor fix or mitigation, confirm the vulnerable path is no longer reachable, and review relevant telemetry for behavior consistent with exploitation. Inventory affected products and versions.

Validate external and internal reachability of the vulnerable function. Apply the vendor fix or mitigation and review telemetry for exploitation indicators when available. Exploit mechanism — Not publicly disclosed in enough technical detail to describe the mechanism without inference.