Vendor
Ivanti vulnerabilities
172 advisories tracked, 36 exploited in the wild according to CISA, 24 published in 2026.
Data refreshed 13 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
CVE-2026-10520Endpoint Manager Mobile and Sentry
Sentry OS Command InjectionCVE-2026-10727Endpoint Manager Mobile and Sentry
OS command injection in Endpoint Manager MobileCVE-2026-10523Endpoint Manager Mobile and Sentry
Authentication Bypass in SentryCVE-2026-6973Endpoint Manager Mobile and Sentry
Endpoint Manager Mobile (EPMM) Improper Input ValidationCVE-2026-1340Endpoint Manager Mobile and Sentry
Endpoint Manager Mobile (EPMM) Code InjectionCVE-2026-1603Endpoint Manager and CSA
Endpoint Manager (EPM) Authentication Bypass
Show all 32Show fewer
CVE-2026-1281Endpoint Manager Mobile and Sentry
Endpoint Manager Mobile (EPMM) Code InjectionCVE-2025-10573Endpoint Manager and CSA
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacke…CVE-2025-10985Endpoint Manager Mobile and Sentry
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo…CVE-2025-10243Endpoint Manager Mobile and Sentry
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo…CVE-2025-10242Endpoint Manager Mobile and Sentry
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo…CVE-2025-9713Endpoint Manager and CSA
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker…CVE-2025-9872Endpoint Manager and CSA
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a r…CVE-2025-9712Endpoint Manager and CSA
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a r…CVE-2025-6770Endpoint Manager Mobile and Sentry
OS command injection in Ivanti Endpoint ManagerCVE-2025-4428Endpoint Manager Mobile and Sentry
Endpoint Manager Mobile (EPMM) Code InjectionCVE-2025-4427Endpoint Manager Mobile and Sentry
Endpoint Manager Mobile (EPMM) Authentication BypassCVE-2025-22457Connect Secure, Policy Secure and ZTA
Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer OverflowCVE-2024-13159Endpoint Manager and CSA
Endpoint Manager (EPM) Absolute Path TraversalCVE-2024-13160Endpoint Manager and CSA
Endpoint Manager (EPM) Absolute Path TraversalCVE-2024-13161Endpoint Manager and CSA
Endpoint Manager (EPM) Absolute Path TraversalCVE-2024-47908Endpoint Manager and CSA
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authentica…CVE-2024-13162Endpoint Manager and CSA
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…CVE-2024-13171Endpoint Manager and CSA
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 Ja…CVE-2025-0283Connect Secure, Policy Secure and ZTA
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before…CVE-2025-0282Connect Secure, Policy Secure and ZTA
Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer OverflowCVE-2024-11773Endpoint Manager and CSA
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated att…CVE-2024-50330Endpoint Manager and CSA
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security…CVE-2024-50326Endpoint Manager and CSA
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security…CVE-2024-50324Endpoint Manager and CSA
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Securit…CVE-2024-9381Endpoint Manager and CSA
Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privile…CVE-2024-8191Endpoint Manager and CSA
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows…
Products covered
Select a product to see only its advisories.
- Connect Secure, Policy Secure and ZTASSL VPN (formerly Pulse Connect Secure), NAC and ZTA gateways59 tracked
- Endpoint Manager Mobile and SentryEPMM (formerly MobileIron Core) and the Sentry gateway26 tracked
- Endpoint Manager and CSAEndpoint Manager (EPM) and the Cloud Services Appliance98 tracked
- Virtual Traffic ManagerApplication delivery controller2 tracked
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-83527 | Endpoint Manager Mobile and Sentry | Authentication Bypass in Sentry | HIGH 8.1 | 1.8% | – | |
| CVE-2026-18851 | Endpoint Manager Mobile and Sentry | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 al… | HIGH 8.8 | 1.0% | – | |
| CVE-2026-18129 | Endpoint Manager and CSA | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024… | HIGH 8.1 | 1.5% | – | |
| CVE-2026-18127 | Endpoint Manager and CSA | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remo… | HIGH 7.7 | 0.72% | – | |
| CVE-2026-18125 | Endpoint Manager and CSA | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unaut… | HIGH 7.5 | 1.6% | – | |
| CVE-2026-10727 | Endpoint Manager Mobile and Sentry | OS command injection in Endpoint Manager Mobile | HIGH 7.2 | 14% | – | |
| CVE-2026-10523 | Endpoint Manager Mobile and Sentry | Authentication Bypass in Sentry | CRITICAL 9.9 | 53% | – | |
| CVE-2026-10520Full analysis | Endpoint Manager Mobile and Sentry | Sentry OS Command Injection | CRITICAL 10 | 100% | Yes | |
| CVE-2026-8992 | Connect Secure, Policy Secure and ZTA | Improper certificate validation in Secure Access Client | HIGH 8.8 | 1.2% | – | |
| CVE-2026-8111 | Endpoint Manager and CSA | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authent… | HIGH 8.8 | 1.6% | – | |
| CVE-2026-8110 | Endpoint Manager and CSA | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a l… | HIGH 7.8 | 0.37% | – | |
| CVE-2026-8109 | Endpoint Manager and CSA | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a… | MEDIUM 6.5 | 1.1% | – | |
| CVE-2026-8051 | Virtual Traffic Manager | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated… | HIGH 7.2 | 3.0% | – | |
| CVE-2026-7432 | Connect Secure, Policy Secure and ZTA | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escala… | HIGH 7.8 | 0.38% | – | |
| CVE-2026-7431 | Connect Secure, Policy Secure and ZTA | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 all… | MEDIUM 4.4 | 0.24% | – | |
| CVE-2026-5787 | Endpoint Manager Mobile and Sentry | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a… | HIGH 8.9 | 0.85% | – | |
| CVE-2026-5788 | Endpoint Manager Mobile and Sentry | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote… | HIGH 7 | 1.5% | – | |
| CVE-2026-7821 | Endpoint Manager Mobile and Sentry | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a re… | HIGH 7.4 | 0.86% | – | |
| CVE-2026-6973 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Improper Input Validation | HIGH 7.2 | 2.5% | Yes | |
| CVE-2026-5786 | Endpoint Manager Mobile and Sentry | Improper Access Control in Endpoint Manager Mobile | HIGH 8.8 | 1.2% | – | |
| CVE-2026-1603 | Endpoint Manager and CSA | Endpoint Manager (EPM) Authentication Bypass | HIGH 8.6 | 88% | Yes | |
| CVE-2026-1602 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.81% | – | |
| CVE-2026-1340 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Code Injection | CRITICAL 9.8 | 99% | Yes | |
| CVE-2026-1281Full analysis | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Code Injection | CRITICAL 9.8 | 99% | Yes | |
| CVE-2025-13662 | Endpoint Manager and CSA | Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Mana… | HIGH 7.8 | 0.58% | – | |
| CVE-2025-13661 | Endpoint Manager and CSA | Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attac… | HIGH 7.1 | 1.4% | – | |
| CVE-2025-13659 | Endpoint Manager and CSA | Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4… | HIGH 8.8 | 2.0% | – | |
| CVE-2025-10573 | Endpoint Manager and CSA | Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacke… | CRITICAL 9.6 | 33% | – | |
| CVE-2025-10918 | Endpoint Manager and CSA | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local… | HIGH 7.1 | 0.24% | – | |
| CVE-2025-10986 | Endpoint Manager Mobile and Sentry | Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a r… | MEDIUM 4.7 | 0.62% | – | |
| CVE-2025-10985 | Endpoint Manager Mobile and Sentry | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo… | HIGH 7.2 | 20% | – | |
| CVE-2025-10243 | Endpoint Manager Mobile and Sentry | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo… | HIGH 7.2 | 20% | – | |
| CVE-2025-10242 | Endpoint Manager Mobile and Sentry | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allo… | HIGH 7.2 | 20% | – | |
| CVE-2025-62384 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.83% | – | |
| CVE-2025-62386 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.82% | – | |
| CVE-2025-62383 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.83% | – | |
| CVE-2025-62391 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.82% | – | |
| CVE-2025-62385 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.82% | – | |
| CVE-2025-62387 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 1.7% | – | |
| CVE-2025-62388 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.82% | – | |
| CVE-2025-62389 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 1.7% | – | |
| CVE-2025-62390 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 1.7% | – | |
| CVE-2025-62392 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.82% | – | |
| CVE-2025-11623 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to… | MEDIUM 6.5 | 0.83% | – | |
| CVE-2025-9713 | Endpoint Manager and CSA | Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker… | HIGH 8.8 | 15% | – | |
| CVE-2025-11622 | Endpoint Manager and CSA | Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated at… | HIGH 7.8 | 0.78% | – | |
| CVE-2025-55144 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | MEDIUM 5.4 | 0.56% | – | |
| CVE-2025-55143 | Connect Secure, Policy Secure and ZTA | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22… | MEDIUM 6.1 | 0.71% | – | |
| CVE-2025-55142 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | HIGH 8.8 | 0.93% | – | |
| CVE-2025-55141 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | HIGH 8.8 | 0.93% | – | |
| CVE-2025-55139 | Connect Secure, Policy Secure and ZTA | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA G… | MEDIUM 6.8 | 0.91% | – | |
| CVE-2025-55148 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | HIGH 7.6 | 0.56% | – | |
| CVE-2025-55147 | Connect Secure, Policy Secure and ZTA | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA G… | HIGH 8.8 | 0.61% | – | |
| CVE-2025-55146 | Connect Secure, Policy Secure and ZTA | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 2… | MEDIUM 4.9 | 0.80% | – | |
| CVE-2025-55145 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | HIGH 8.9 | 0.65% | – | |
| CVE-2025-8711 | Connect Secure, Policy Secure and ZTA | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA G… | MEDIUM 5.4 | 0.33% | – | |
| CVE-2025-8712 | Connect Secure, Policy Secure and ZTA | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R… | MEDIUM 5.4 | 0.45% | – | |
| CVE-2025-9872 | Endpoint Manager and CSA | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a r… | HIGH 8.8 | 14% | – | |
| CVE-2025-9712 | Endpoint Manager and CSA | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a r… | HIGH 8.8 | 21% | – | |
| CVE-2025-5468 | Connect Secure, Policy Secure and ZTA | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Poli… | MEDIUM 5.5 | 0.36% | – | |
| CVE-2025-5466 | Connect Secure, Policy Secure and ZTA | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Ga… | MEDIUM 4.9 | 0.68% | – | |
| CVE-2025-5462 | Connect Secure, Policy Secure and ZTA | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure befor… | HIGH 7.5 | 1.1% | – | |
| CVE-2025-5456 | Connect Secure, Policy Secure and ZTA | Buffer over-read in Connect Secure, Policy Secure and others | HIGH 7.5 | 1.1% | – | |
| CVE-2025-0292 | Connect Secure, Policy Secure and ZTA | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allo… | MEDIUM 5.5 | 0.57% | – | |
| CVE-2025-0293 | Connect Secure, Policy Secure and ZTA | CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.… | MEDIUM 6.6 | 0.41% | – | |
| CVE-2025-5464 | Connect Secure, Policy Secure and ZTA | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows… | MEDIUM 6.5 | 0.31% | – | |
| CVE-2025-6770 | Endpoint Manager Mobile and Sentry | OS command injection in Ivanti Endpoint Manager | HIGH 7.2 | 20% | – | |
| CVE-2025-5463 | Connect Secure, Policy Secure and ZTA | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Iva… | MEDIUM 5.5 | 0.31% | – | |
| CVE-2025-5451 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure bef… | MEDIUM 4.9 | 0.70% | – | |
| CVE-2025-5450 | Connect Secure, Policy Secure and ZTA | Improper access control in the certificate management component of Ivanti Connect Secure before version 22.… | MEDIUM 6.3 | 0.27% | – | |
| CVE-2025-7037 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager | HIGH 7.2 | 0.95% | – | |
| CVE-2025-6996 | Endpoint Manager and CSA | Improper Encryption in Ivanti Endpoint Manager | HIGH 8.4 | 0.19% | – | |
| CVE-2025-6995 | Endpoint Manager and CSA | Improper Encryption in Ivanti Endpoint Manager | HIGH 8.4 | 0.19% | – | |
| CVE-2025-4428 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Code Injection | HIGH 7.2 | 87% | Yes | |
| CVE-2025-4427 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Authentication Bypass | MEDIUM 5.3 | 100% | Yes | |
| CVE-2025-22460 | Endpoint Manager and CSA | Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated… | HIGH 7.8 | 0.34% | – | |
| CVE-2025-22466 | Endpoint Manager and CSA | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote… | HIGH 8.2 | 1.4% | – | |
| CVE-2025-22465 | Endpoint Manager and CSA | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote… | MEDIUM 6.1 | 0.71% | – | |
| CVE-2025-22464 | Endpoint Manager and CSA | Untrusted pointer dereference in Endpoint Manager | MEDIUM 6.1 | 0.24% | – | |
| CVE-2025-22461 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote… | HIGH 7.2 | 1.5% | – | |
| CVE-2025-22459 | Endpoint Manager and CSA | Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 S… | MEDIUM 4.8 | 0.38% | – | |
| CVE-2025-22458 | Endpoint Manager and CSA | DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authe… | HIGH 7.8 | 0.40% | – | |
| CVE-2025-22457 | Connect Secure, Policy Secure and ZTA | Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow | CRITICAL 9 | 100% | Yes · ransomware | |
| CVE-2025-22454 | Connect Secure, Policy Secure and ZTA | Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenti… | HIGH 7.8 | 0.30% | – | |
| CVE-2024-13813 | Connect Secure, Policy Secure and ZTA | Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated… | HIGH 7.1 | 0.21% | – | |
| CVE-2024-13843 | Connect Secure, Policy Secure and ZTA | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure… | MEDIUM 6 | 0.36% | – | |
| CVE-2024-13842 | Connect Secure, Policy Secure and ZTA | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22… | MEDIUM 6 | 0.32% | – | |
| CVE-2024-13830 | Connect Secure, Policy Secure and ZTA | Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7… | MEDIUM 6.1 | 0.74% | – | |
| CVE-2024-12058 | Connect Secure, Policy Secure and ZTA | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure b… | MEDIUM 6.8 | 1.1% | – | |
| CVE-2024-10644 | Connect Secure, Policy Secure and ZTA | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.… | CRITICAL 9.1 | 2.8% | – | |
| CVE-2025-22467 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticate… | CRITICAL 9.9 | 4.7% | – | |
| CVE-2024-11771 | Endpoint Manager and CSA | Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restri… | MEDIUM 5.3 | 1.2% | – | |
| CVE-2024-47908 | Endpoint Manager and CSA | OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authentica… | CRITICAL 9.1 | 22% | – | |
| CVE-2024-13162 | Endpoint Manager and CSA | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security… | HIGH 7.2 | 64% | – | |
| CVE-2024-13163 | Endpoint Manager and CSA | Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 J… | HIGH 7.8 | 9.2% | – | |
| CVE-2024-13164 | Endpoint Manager and CSA | An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2… | HIGH 7.8 | 0.38% | – | |
| CVE-2024-13165 | Endpoint Manager and CSA | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.5 | 2.6% | – | |
| CVE-2024-13166 | Endpoint Manager and CSA | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.5 | 2.4% | – | |
| CVE-2024-13167 | Endpoint Manager and CSA | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.5 | 2.6% | – | |
| CVE-2024-13168 | Endpoint Manager and CSA | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.5 | 2.6% | – | |
| CVE-2024-13169 | Endpoint Manager and CSA | An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.8 | 0.44% | – | |
| CVE-2024-13170 | Endpoint Manager and CSA | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025… | HIGH 7.5 | 2.7% | – | |
| CVE-2024-13171 | Endpoint Manager and CSA | Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 Ja… | HIGH 7.8 | 18% | – | |
| CVE-2024-13172 | Endpoint Manager and CSA | Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 Jan… | HIGH 7.8 | 0.51% | – | |
| CVE-2024-13158 | Endpoint Manager and CSA | An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 J… | HIGH 7.2 | 3.5% | – | |
| CVE-2024-13159 | Endpoint Manager and CSA | Endpoint Manager (EPM) Absolute Path Traversal | CRITICAL 9.8 | 100% | Yes | |
| CVE-2024-13160 | Endpoint Manager and CSA | Endpoint Manager (EPM) Absolute Path Traversal | CRITICAL 9.8 | 91% | Yes | |
| CVE-2024-13161 | Endpoint Manager and CSA | Endpoint Manager (EPM) Absolute Path Traversal | CRITICAL 9.8 | 90% | Yes | |
| CVE-2024-10811 | Endpoint Manager and CSA | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-202… | CRITICAL 9.8 | 3.6% | – | |
| CVE-2025-0283 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before… | HIGH 7 | 17% | – | |
| CVE-2025-0282 | Connect Secure, Policy Secure and ZTA | Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow | CRITICAL 9 | 100% | Yes · ransomware | |
| CVE-2024-11773 | Endpoint Manager and CSA | SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated att… | CRITICAL 9.1 | 23% | – | |
| CVE-2024-11772 | Endpoint Manager and CSA | Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated… | CRITICAL 9.1 | 7.7% | – | |
| CVE-2024-11639 | Endpoint Manager and CSA | An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticate… | CRITICAL 10 | 4.9% | – | |
| CVE-2024-8540 | Endpoint Manager Mobile and Sentry | Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticat… | HIGH 8.8 | 0.25% | – | |
| CVE-2024-11634 | Connect Secure, Policy Secure and ZTA | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version… | CRITICAL 9.1 | 1.8% | – | |
| CVE-2024-11633 | Connect Secure, Policy Secure and ZTA | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker… | CRITICAL 9.1 | 1.7% | – | |
| CVE-2024-9844 | Connect Secure, Policy Secure and ZTA | Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.… | HIGH 7.1 | 0.99% | – | |
| CVE-2024-10256 | Endpoint Manager and CSA | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker t… | HIGH 7.1 | 0.21% | – | |
| CVE-2024-7571 | Connect Secure, Policy Secure and ZTA | Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to… | HIGH 7.8 | 0.26% | – | |
| CVE-2024-9843 | Connect Secure, Policy Secure and ZTA | A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to… | MEDIUM 5 | 0.26% | – | |
| CVE-2024-9842 | Connect Secure, Policy Secure and ZTA | Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated att… | HIGH 7.3 | 0.21% | – | |
| CVE-2024-8539 | Connect Secure, Policy Secure and ZTA | Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated at… | HIGH 7.1 | 0.22% | – | |
| CVE-2024-11004 | Connect Secure, Policy Secure and ZTA | Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7… | MEDIUM 6.1 | 0.85% | – | |
| CVE-2024-11005 | Connect Secure, Policy Secure and ZTA | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Pol… | CRITICAL 9.1 | 1.6% | – | |
| CVE-2024-11006 | Connect Secure, Policy Secure and ZTA | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Pol… | CRITICAL 9.1 | 1.6% | – | |
| CVE-2024-11007 | Connect Secure, Policy Secure and ZTA | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Pol… | CRITICAL 9.1 | 1.6% | – | |
| CVE-2024-8495 | Connect Secure, Policy Secure and ZTA | A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before… | HIGH 7.5 | 1.4% | – | |
| CVE-2024-47909 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure bef… | MEDIUM 4.9 | 1.1% | – | |
| CVE-2024-47907 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote una… | HIGH 7.5 | 1.6% | – | |
| CVE-2024-47906 | Connect Secure, Policy Secure and ZTA | Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and… | HIGH 7.8 | 0.22% | – | |
| CVE-2024-9420 | Connect Secure, Policy Secure and ZTA | A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure b… | HIGH 8.8 | 1.4% | – | |
| CVE-2024-47905 | Connect Secure, Policy Secure and ZTA | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure bef… | MEDIUM 4.9 | 1.1% | – | |
| CVE-2024-50330 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security… | CRITICAL 9.8 | 40% | – | |
| CVE-2024-50329 | Endpoint Manager and CSA | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Securit… | HIGH 8.8 | 1.7% | – | |
| CVE-2024-50328 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security… | HIGH 7.2 | 1.8% | – | |
| CVE-2024-50327 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security… | HIGH 7.2 | 1.1% | – | |
| CVE-2024-50326 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security… | HIGH 7.2 | 26% | – | |
| CVE-2024-50324 | Endpoint Manager and CSA | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Securit… | HIGH 7.2 | 19% | – | |
| CVE-2024-50323 | Endpoint Manager and CSA | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security… | HIGH 7.8 | 0.67% | – | |
| CVE-2024-50322 | Endpoint Manager and CSA | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Securit… | HIGH 7.8 | 6.0% | – | |
| CVE-2024-9381 | Endpoint Manager and CSA | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privile… | HIGH 7.2 | 16% | – | |
| CVE-2024-9380 | Endpoint Manager and CSA | Cloud Services Appliance (CSA) OS Command Injection | HIGH 7.2 | 60% | Yes | |
| CVE-2024-9379 | Endpoint Manager and CSA | Cloud Services Appliance (CSA) SQL Injection | MEDIUM 6.5 | 44% | Yes | |
| CVE-2024-7612 | Endpoint Manager Mobile and Sentry | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitiv… | HIGH 8.8 | 0.24% | – | |
| CVE-2024-8963 | Endpoint Manager and CSA | Cloud Services Appliance (CSA) Path Traversal | CRITICAL 9.4 | 99% | Yes | |
| CVE-2024-8441 | Endpoint Manager and CSA | An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows… | MEDIUM 6.7 | 0.36% | – | |
| CVE-2024-8322 | Endpoint Manager and CSA | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows… | MEDIUM 4.3 | 1.1% | – | |
| CVE-2024-8321 | Endpoint Manager and CSA | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update all… | MEDIUM 5.8 | 1.8% | – | |
| CVE-2024-8320 | Endpoint Manager and CSA | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update all… | MEDIUM 5.3 | 1.2% | – | |
| CVE-2024-8191 | Endpoint Manager and CSA | SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows… | HIGH 7.8 | 20% | – | |
| CVE-2024-8190 | Endpoint Manager and CSA | Cloud Services Appliance OS Command Injection | HIGH 7.2 | 89% | Yes | |
| CVE-2024-7593 | Virtual Traffic Manager | Virtual Traffic Manager Authentication Bypass | CRITICAL 9.8 | 100% | Yes | |
| CVE-2024-29824 | Endpoint Manager and CSA | Endpoint Manager (EPM) SQL Injection | CRITICAL 9.6 | 100% | Yes | |
| CVE-2024-21893 | ICS, IPS | Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) | HIGH 8.2 | 100% | Yes · ransomware | |
| CVE-2024-21887 | ICS, IPS | Connect Secure and Policy Secure Command Injection | CRITICAL 9.1 | 100% | Yes · ransomware | |
| CVE-2023-46805 | ICS, IPS | Connect Secure and Policy Secure Authentication Bypass | HIGH 8.2 | 100% | Yes · ransomware | |
| CVE-2023-38035 | Endpoint Manager Mobile and Sentry | Sentry Authentication Bypass | CRITICAL 9.8 | 100% | Yes · ransomware | |
| CVE-2023-35082 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass | CRITICAL 10 | 100% | Yes · ransomware | |
| CVE-2023-35081 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile (EPMM) Path Traversal | HIGH 7.2 | 64% | Yes | |
| CVE-2023-35078 | Endpoint Manager Mobile and Sentry | Endpoint Manager Mobile Authentication Bypass | CRITICAL 10 | 100% | Yes · ransomware | |
| CVE-2021-44529 | Endpoint Manager and CSA | Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | CRITICAL 9.8 | 99% | Yes · ransomware | |
| CVE-2021-22900 | Pulse Secure Secure | Pulse Connect Secure Unrestricted File Upload | HIGH 7.2 | 14% | Yes | |
| CVE-2021-22899 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Command Injection | HIGH 8.8 | 23% | Yes | |
| CVE-2021-22894 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Collaboration Suite Buffer Overflow | HIGH 8.8 | 41% | Yes | |
| CVE-2021-22893 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Use-After-Free | CRITICAL 10 | 47% | Yes · ransomware | |
| CVE-2020-8260 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Code Execution | HIGH 7.2 | 96% | Yes | |
| CVE-2020-8243 | Pulse Connect Secre | Pulse Connect Secure Code Execution | HIGH 7.2 | 91% | Yes | |
| CVE-2020-8218 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Code Injection | HIGH 7.2 | 32% | Yes | |
| CVE-2020-15505 | Endpoint Manager Mobile and Sentry | MobileIron Multiple Products Remote Code Execution | CRITICAL 9.8 | 100% | Yes | |
| CVE-2019-11510 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure Arbitrary File Read | CRITICAL 9.9 | 100% | Yes · ransomware | |
| CVE-2019-11539 | Connect Secure, Policy Secure and ZTA | Pulse Connect Secure and Policy Secure Command Injection | HIGH 8 | 99% | Yes · ransomware |
Sources: Ivanti security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.