CVE-2026-55401

Executive Summary

CVE-2026-55401 is an unauthenticated NULL pointer dereference (CWE-476) vulnerability in the load-balancing sub-system of Ivanti Secure Access servers running versions prior to 14.57. A remote attacker can send a single specially crafted packet to an internet-facing Secure Access server with load balancing enabled, causing the internal load balancer to crash while the server itself remains operational. The primary impact is denial of service against the load-balancing function, with no known public exploit, no CISA KEV listing, and no confirmed vendor patch at the time of writing.

Technical Analysis

The vulnerability belongs to the NULL pointer dereference class (CWE-476). In this flaw class, a program dereferences a pointer that has not been initialized or has been set to NULL, which typically raises an exception and terminates the affected process or sub-system. The NVD description places the defect in the load-balancing sub-system of the Secure Access appliance — the component responsible for distributing client connections across configured backend resources and for coordinating failover behavior in high-availability deployments.

The attack surface is the network itself. The description states that an attacker sends an "unauthenticated packet" to the affected server; no credentials, session, or prior access are required. Because the load-balancing sub-system listens on network-facing interfaces when load balancing is enabled, any reachable Secure Access appliance with this feature active is exposed. The exact packet structure, protocol, and destination port are not disclosed in the NVD description or the CNA title, so implementation-level details such as function names, URL paths, or specific malformed fields cannot be derived from the available data. At the vulnerability-class level, the trigger is consistent with a packet that omits an expected field or contains a structurally invalid element, causing the load-balancing code to follow a NULL pointer while parsing or processing the request.

A notable operational characteristic is the crash's blast radius. The NVD description explicitly states that after a successful attack, the Secure Access server is still able to accept connections and can still issue a failover to connected clients. This indicates that the crash is isolated to the internal load-balancer process rather than the entire appliance; the core SSL VPN / remote-access function continues running. The side effect is that the appliance's ability to load-balance traffic is degraded and failover is actively triggered, which can disrupt existing client sessions that are moved to another node in a cluster.

The NVD description embeds a CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L. This confirms a network-reachable, low-complexity, unauthenticated attack with no confidentiality or integrity impact, low availability impact on the vulnerable system, and low availability impact on subsequent systems. The official CVSS score field for this CVE is listed as N/A in the provided intelligence data, so no numeric score is asserted here; the vector is reproduced only as it appears in the NVD description. The EPSS score of 0.00312 (23.9% percentile) indicates that exploitation is not currently widespread, consistent with the absence of a public PoC, Nuclei template, or in-the-wild campaign evidence.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit code exists, and no specific packet layout has been disclosed, so the chain is described at the class level.

1. Reconnaissance / target identification: An attacker identifies internet-facing Ivanti Secure Access appliances using Shodan or Censys queries such as title:"Ivanti Secure Access" or product:"Ivanti Secure Access". The attacker then fingerprints the version (via login banners or response headers) to confirm the target runs a build prior to 14.57 and probes whether load balancing is enabled — for example, by observing failover-related behaviors or distinct LB listener responses during service enumeration.

2. Triggering the flaw: The attacker crafts an unauthenticated network packet directed at the load-balancing sub-system. The precise content is unknown, but the flaw class implies the packet is missing a required field or contains an input element that the LB parser does not expect, resulting in a code path where a NULL pointer is dereferenced instead of a valid object.

3. Payload / execution method: The packet is transmitted to the target IP/port without any authentication step. No valid credentials, client certificate, or VPN session are required. On receipt, the vulnerable LB code dereferences the NULL pointer, raising an unhandled exception that terminates the internal load balancer process. Because the crash is in-process to the LB sub-system, the core Secure Access service continues to run, but load-balancing functionality stops.

4. Post-exploitation impact: The load balancer is down, and the appliance triggers failover for connected clients, migrating sessions to an alternate node if one is configured in a cluster. In a single-node deployment, the LB remains unavailable until manually restarted or until the appliance auto-recovers. An attacker can repeat the one-packet attack indefinitely, keeping the LB sub-system in a crash loop and denying load-balancing service to legitimate users. The attack does not grant code execution, data access, or administrative control — it is a pure availability attack against the LB function, with a downstream availability effect on any services that depend on load-balanced distribution.

Impact Assessment

The business impact of CVE-2026-55401 is concentrated in availability. The embedded CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) shows zero confidentiality and integrity impact and low availability impact on both the vulnerable system and subsequent systems. This makes the vulnerability unattractive to actors seeking data theft or ransomware deployment, but highly relevant to threat actors conducting denial-of-service operations against remote-access infrastructure.

Organizations affected are those running Ivanti Secure Access / remote-access appliances with load balancing enabled, prior to version 14.57. Typical blast radius includes:

• High-availability (HA) clusters: A crashed LB triggers failover, which can interrupt active user sessions and cause a load spike on the surviving node. Repeated attacks could cause flapping between nodes, degrading the entire cluster's stability.
• Load-balanced SSL VPN deployments: If the appliance distributes traffic across multiple back-end resources, loss of the LB sub-system halts that distribution even though the appliance continues to accept connections.
• Operational availability: The one-packet, unauthenticated nature of the attack means a single attacker can keep the LB down with minimal effort and no bandwidth cost; a distributed botnet amplifies this into a sustained outage.

Risk factors that raise the severity profile: the vulnerability is unauthenticated and remotely reachable, the product is typically internet-facing, and the patch confidence is 0/4 — no fix is currently tracked by the monitoring sources. On the other hand, EPSS (0.00312, 23.9% percentile) and the absence of CISA KEV placement, public PoCs, and exploit code all indicate that exploitation is not yet observed in the wild. The risk posture is therefore "high potential, currently unrealized" — an unpatched, network-exposed DoS primitive that can be weaponized as soon as technical details become public.

Detection Guidance

Detection is challenging because the NVD description does not disclose the specific packet signature, port, or log message produced by the crash. The following rules therefore focus on behavioral indicators: crash and restart events for the load-balancer process, repeated failover activity, and anomalous connection patterns to the Secure Access appliance. Tune thresholds to your environment; replace generic process name placeholders with the locally observed LB service name (not provided in NVD data).

Sigma Rule

title: Ivanti Secure Access Load Balancer Process Crash
id: 53e9f1c4-8b2a-4f6b-9c3d-2f9e7a1b4c5d
status: experimental
description: Detects suspicious termination/restart patterns of the load-balancer process on Ivanti Secure Access appliances, consistent with CVE-2026-55401 NULL pointer dereference exploitation.
logsource:
    product: windows
    service: system
detection:
    selection_crash:
        EventID:
            - 4689   # Process termination (Windows)
            - 1000   # Application Error (WER)
            - 7031   # Service terminated unexpectedly (Windows)
        ProcessName|endswith:
            - '\\loadbalancer.exe'      # placeholder - adjust to observed process name
            - '\\lbd.exe'               # placeholder - adjust to observed process name
    selection_failover:
        Message|contains:
            - 'failover'
            - 'load balancer'
            - 'NULL pointer'
    timeframe: 5m
    condition: selection_crash or selection_failover
    filter:
        Message|contains: 'expected maintenance'
level: high
falsepositives:
    - Legitimate service restart during maintenance windows
    - Vendor-initiated failover testing

YARA Rule

rule CVE_2026_55401_Ivanti_SecureAccess_LB_Hunt
{
    meta:
        author = "Valters IT SOC"
        description = "Hunts for artifacts referencing CVE-2026-55401 or crash indicators of the Ivanti Secure Access load-balancing sub-system in logs, capture files, and forensic images."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55401"
        date = "2026-05-07"
        cve = "CVE-2026-55401"
        severity = "medium"
    strings:
        $cve = "CVE-2026-55401" ascii wide nocase
        $lb1 = "load balancer" ascii wide nocase
        $lb2 = "load-balancing" ascii wide nocase
        $crash1 = "NULL pointer" ascii wide nocase
        $crash2 = "segmentation fault" ascii wide nocase
        $crash3 = "crashed" ascii wide nocase
        $failover = "failover" ascii wide nocase
    condition:
        $cve or (($lb1 or $lb2) and ($crash1 or $crash2 or $crash3) and 1 of ($failover))
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"ET TROJAN Possible Ivanti Secure Access LB DoS Probing (CVE-2026-55401)"; flow:to_server; flags:S; threshold:type both, track by_src, count 50, seconds 10; metadata:created_at 2026_05_07, updated_at 2026_05_07, cve CVE-2026-55401; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55401; sid:202655401; rev:1;)

# Secondary rule: alert on repeated crash/failover strings in cleartext management/LB traffic (if LB protocol is
# unencrypted in your deployment). Disable if the LB channel is TLS-encrypted.
alert tcp any any -> $HOME_NET any (msg:"ET INFO Ivanti Secure Access LB Crash/Failover Indicator (CVE-2026-55401)"; flow:to_server; content:"failover"; nocase; content:"load"; distance:0; nocase; classtype:attempted-dos; metadata:cve CVE-2026-55401; sid:202655402; rev:1;)

Elastic Detection

sequence with maxspan=5m
  [ process where event.action == "process_ended" and
      process.name in ("loadbalancer.exe", "lbd.exe") ]   // placeholder names
  [ process where event.action == "process_started" and
      process.name in ("loadbalancer.exe", "lbd.exe") ]
  [ process where event.action == "process_ended" and
      process.name in ("loadbalancer.exe", "lbd.exe") ]

// Alternative log-based detection where appliance logs are shipped to Elasticsearch
sequence by host.name with maxspan=10m
  [ any where message like~ "*load balancer*" and message like~ "*crash*" ]
  [ any where message like~ "*failover*" ]

Splunk SPL Query

index=windows (EventCode=4689 OR EventCode=1000 OR EventCode=7031)
  "loadbalancer.exe" OR "lbd.exe"
| stats count min(_time) as firstTime max(_time) as lastTime by host, ProcessName, Message
| where count >= 3
| eval timeframe = tostring(lastTime - firstTime, "duration")
| table _time host ProcessName count timeframe Message
| sort - count

index=secureaccess sourcetype="ivanti:secureaccess:*"   // placeholder sourcetype
  ("load balancer" AND "crash") OR "failover"
| bucket _time span=5m
| stats count by _time, src_ip, dest_ip
| where count > 20

Wazuh OSSEC Rule

<group name="ivanti_secureaccess,">
  <!-- CVE-2026-55401: Null pointer dereference in load-balancing sub-system -->
  <rule id="319765" level="10" frequency="3" timeframe="300">
    <if_sid>5540100</if_sid>
    <match>load balancer|load-balancer|load_balancer</match>
    <match>crash|NULL pointer|failed|terminated</match>
    <description>Ivanti Secure Access: repeated load-balancer crash events detected (possible CVE-2026-55401 exploitation)</description>
    <group>dos,ivanti,cve-2026-55401,</group>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>

  <rule id="319766" level="6">
    <match>failover</match>
    <description>Ivanti Secure Access: failover event observed</description>
    <group>ivanti,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, patch artifact, or fixed build is currently confirmed by the tracked sources. The NVD description's "prior to 14.57" phrasing strongly implies that version 14.57 is the first release containing a fix, but until an official Ivanti advisory is published, treat the vulnerability as unpatched.

1. Immediate mitigations (do now):

   • If load balancing is not strictly required for your Secure Access deployment, disable it on all appliances to eliminate the attack surface entirely.
   • If load balancing must remain enabled, restrict network access to the load-balancing sub-system using firewall ACLs so that only trusted management networks and peer LB nodes can reach it. Do not expose LB interfaces to the internet or to untrusted segments.
   • Monitor for crash-loop and failover-flapping behavior; configure alerting on LB process restarts and unexpected failover events using the detection rules above.
   • Review high-availability cluster topology; ensure failover targets have sufficient headroom to absorb sessions if an LB crash triggers a mass failover.

2. Patch / upgrade steps:

   • Track the Ivanti Security Advisory portal and CVE-2026-55401 on NVD for the official fix announcement.
   • When available, upgrade affected appliances to version 14.57 or later. Test the upgrade in a staging environment first, verify LB functionality and failover behavior after upgrade, then roll out to production.
   • If the appliance is managed via Ivanti cloud/management tooling, verify that the management layer also receives the relevant build if it participates in load balancing.
   • No workarounds are provided by the vendor in the current data; treat feature-level disablement (mitigation #1) as the interim control.

3. Long-term hardening:

   • Segment all remote-access infrastructure into a dedicated DMZ with strict egress/ingress rules; never place management or LB interfaces on the same network segment as general user traffic.
   • Implement IPS/IDS coverage (Suricata/Snort) tuned with the rules above, plus behavioral analytics (Splunk/Wazuh/Elastic) for crash and failover anomalies.
   • Track EPSS and CISA KEV on a weekly basis for this CVE; if it is added to KEV or EPSS rises sharply, prioritize emergency patching.
   • Maintain an asset inventory of all Secure Access versions and LB-enabled appliances to ensure rapid patching when the vendor fix lands.
   • Subscribe to Ivanti's security bulletin RSS feed and FIRST/CISA CVE feeds to close the current patch-intelligence gap (0/4 patch confidence).

References

1. NVD Entry for CVE-2026-55401 — https://nvd.nist.gov/vuln/detail/CVE-2026-55401
2. FIRST CVSS v4.0 Calculator (vector as referenced in NVD description) — https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
3. Ivanti Security Advisories (vendor advisory when released) — https://www.ivanti.com/support/security-advisories
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-55401 is currently not listed)
5. FIRST EPSS Feed — https://www.first.org/epss/ (score 0.00312, 23.9% percentile as of writing)

Known threat-actor activity: None reported. There is no CISA KEV entry, no public PoC, no exploit code, and no Nuclei template associated with CVE-2026-55401 at the time of this report. Exploitation-in-the-wild evidence is absent; the attack chain described above is inferred from the vulnerability class and NVD description only.