Ivanti Policy Secure vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ivanti Policy Secure: 8 record(s), with affected versions and fixes.cpe:2.3:a:ivanti:policy_secure
CVE-2025-22457
Critical · 9.8
KEV Urgent · 88 Public exploit Ransomware CWE-787 Apr 3, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2025-0282
Critical · 9.0
KEV Urgent · 88 Public exploit Ransomware CWE-787 Jan 8, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-21893
High · 8.2
KEV Urgent · 89 Public exploit Ransomware CWE-918 Jan 31, 2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-21887
Critical · 9.1
KEV Urgent · 90 Public exploit Ransomware CWE-77 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805
High · 8.2
KEV Urgent · 99 Public exploit Ransomware CWE-287 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2020-8243
High · 7.2
KEV High · 56 CWE-94 Sep 30, 2020
Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVE-2020-8218
High · 7.2
KEV High · 62 Public exploit CWE-94 Jul 30, 2020
Pulse Connect Secure Code Injection Vulnerability
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2019-11539
High · 7.2
KEV Urgent · 86 Public exploit Ransomware CWE-78 Apr 25, 2019
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.