CVE Intelligence
Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

Severidade
Limpar

36 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-104935 Alta · 8.6 KEV Alta · 69 Exploit público CWE-290 13/10/2026
Bypass de Autenticação por Spoofing no Ivanti Connect Secure
Bypass de autenticação por spoofing no ICS anterior à versão 25.1.3.0 permite que um atacante remoto não autenticado execute comandos arbitrários. Isso não afeta o ICS versão 22.7R2.14 ou anteriores.
CVE-2026-10520 Crítica · 10.0 KEV Urgente · 73 Exploit público CWE-78 09/06/2026
Ivanti Sentry OS Command Injection Vulnerability
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2026-6973 Alta · 7.2 KEV Alta · 56 CWE-20 07/05/2026
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-1603 Alta · 7.5 KEV Alta · 63 Exploit público CWE-306 10/02/2026
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CVE-2026-1281 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-1340 Crítica · 9.8 KEV Urgente · 79 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2025-4427 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-288 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
CVE-2025-4428 Alta · 8.8 KEV Urgente · 77 Exploit público CWE-94 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVE-2025-22457 Crítica · 9.8 KEV Urgente · 88 Exploit público Ransomware CWE-787 03/04/2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-13159 Alta · 7.5 KEV Alta · 69 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13160 Alta · 7.5 KEV Alta · 63 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13161 Alta · 7.5 KEV Alta · 63 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2025-0282 Crítica · 9.0 KEV Urgente · 88 Exploit público Ransomware CWE-787 08/01/2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-9379 Alta · 7.2 KEV Alta · 56 CWE-89 08/10/2024
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVE-2024-9380 Alta · 7.2 KEV Alta · 56 CWE-78 08/10/2024
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVE-2024-8963 Crítica · 9.1 KEV Urgente · 73 Exploit público CWE-22 19/09/2024
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVE-2024-8190 Alta · 7.2 KEV Alta · 62 Exploit público CWE-78 10/09/2024
Ivanti Cloud Services Appliance OS Command Injection Vulnerability
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
CVE-2024-7593 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-287 13/08/2024
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVE-2024-29824 Alta · 8.8 KEV Urgente · 79 Exploit público CWE-89 31/05/2024
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVE-2024-21893 Alta · 8.2 KEV Urgente · 89 Exploit público Ransomware CWE-918 31/01/2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-21887 Crítica · 9.1 KEV Urgente · 90 Exploit público Ransomware CWE-77 12/01/2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805 Alta · 8.2 KEV Urgente · 99 Exploit público Ransomware CWE-287 12/01/2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-38035 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-863 21/08/2023
Ivanti Sentry Authentication Bypass Vulnerability
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-35082 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-287 15/08/2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2023-35081 Alta · 7.2 KEV Alta · 56 CWE-22 03/08/2023
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.