Ivanti vulnerabilities
Published CVEs affecting Ivanti products: 110 record(s), with severity, exploitation and fixes.
Endpoint Manager 30Connect Secure 27Policy Secure 19Endpoint Manager Mobile 18Zero Trust Access Gateway 12Neurons For Secure Access 11ZTA Gateway 11Neurons For Itsm 8Xtraction 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4ICS 3Neurons for ITSM (Cloud) 3Secure Access Client 3IPS 3Sentry 3EPMM 2Virtual Traffic Manager 2Standalone Sentry 2Neurons for ITSM (On-Premise) 2Neurons For Zero-trust Access 2Neurons for ZTA gateways 2Connect Secure before 1Connect Secure 22.7R2.9 1Neurons for Secure 1Desktop and Server Management 1Neurons for ITSM (On-Premises) 1Neurons Patch for Intune 1Desktop & Server Management 1MobileIron Sentry 1Cloud Services Appliance 1vTM 1EPM 1
CVE-2026-10520
Critical · 10.0
KEV Urgent · 73 Public exploit CWE-78 Jun 9, 2026
Ivanti Sentry OS Command Injection Vulnerability
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2026-9614
High · 8.8
CWE-284 Jun 1, 2026
Improper Access Control in Ivanti Neurons for ITSM (On-Premises)
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
CVE-2026-8992
High · 8.8
CWE-295 May 22, 2026
Improper Certificate Validation in Ivanti Secure Access Client
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
CVE-2026-8111
High · 8.8
CWE-89 May 12, 2026
SQL Injection in Ivanti Endpoint Manager
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
CVE-2026-8110
High · 7.8
CWE-732 May 12, 2026
Incorrect Permission Assignment for Critical Resource in Ivanti Endpoint Manager
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
CVE-2026-8109
Medium · 6.5
CWE-749 May 12, 2026
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version…
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
CVE-2026-8051
High · 7.2
CWE-78 May 12, 2026
OS Command Injection in Ivanti Virtual Traffic Manager
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2026-8043
Critical · 9.6
CWE-73 May 12, 2026
External control of a file name in Ivanti Xtraction before version 2026.2 allows a…
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
CVE-2026-7432
High · 7.0
CWE-362 May 12, 2026
Race Condition in Ivanti Secure Access Client
A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
CVE-2026-7431
Medium · 4.4
CWE-732 May 12, 2026
Incorrect Permission Assignment for Critical Resource in Ivanti Secure Access Client
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
CVE-2026-7821
Critical · 9.1
CWE-295 May 7, 2026
Improper Certificate Validation in Ivanti Endpoint Manager Mobile
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
CVE-2026-6973
High · 7.2
KEV High · 54 CWE-20 May 7, 2026
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-5788
Critical · 9.8
CWE-284 May 7, 2026
Improper Access Control in Ivanti Endpoint Manager Mobile
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
CVE-2026-5787
Critical · 9.1
CWE-295 May 7, 2026
Improper Certificate Validation in Ivanti Endpoint Manager Mobile
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
CVE-2026-5786
High · 8.8
CWE-284 May 7, 2026
Improper Access Control in Ivanti Endpoint Manager Mobile
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
CVE-2026-4914
Medium · 5.4
CWE-79 Apr 14, 2026
Cross-site Scripting (XSS) in Ivanti Neurons for ITSM (On-Premise)
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.
CVE-2026-4913
Medium · 5.7
CWE-424 Apr 14, 2026
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a…
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.
CVE-2026-3483
High · 7.8
CWE-749 Mar 10, 2026
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local…
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.
CVE-2026-1602
Medium · 6.5
CWE-89 Feb 10, 2026
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2026-1603
High · 7.5
KEV High · 63 Public exploit CWE-306 Feb 10, 2026
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CVE-2026-1281
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-94 Jan 29, 2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-1340
Critical · 9.8
KEV Urgent · 79 Public exploit CWE-94 Jan 29, 2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2025-13662
High · 7.8
CWE-347 Dec 9, 2025
Improper Verification of Cryptographic Signature in Ivanti Endpoint Manager
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
CVE-2025-13661
High · 8.0
CWE-22 Dec 9, 2025
Path Traversal in Ivanti Endpoint Manager
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
CVE-2025-13659
High · 8.8
CWE-913 Dec 9, 2025
Improper Control of Dynamically-Managed Code Resources in Ivanti Endpoint Manager
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.