Ivanti vulnerabilities
Published CVEs affecting Ivanti products: 110 record(s), with severity, exploitation and fixes.
Endpoint Manager 30Connect Secure 27Policy Secure 19Endpoint Manager Mobile 18Zero Trust Access Gateway 12Neurons For Secure Access 11ZTA Gateway 11Neurons For Itsm 8Xtraction 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4ICS 3Neurons for ITSM (Cloud) 3Secure Access Client 3IPS 3Sentry 3EPMM 2Virtual Traffic Manager 2Standalone Sentry 2Neurons for ITSM (On-Premise) 2Neurons For Zero-trust Access 2Neurons for ZTA gateways 2Connect Secure before 1Connect Secure 22.7R2.9 1Neurons for Secure 1Desktop and Server Management 1Neurons for ITSM (On-Premises) 1Neurons Patch for Intune 1Desktop & Server Management 1MobileIron Sentry 1Cloud Services Appliance 1vTM 1EPM 1
CVE-2025-10573
Medium · 6.1
CWE-79 Dec 9, 2025
Cross-site Scripting (XSS) in Ivanti Endpoint Manager
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
CVE-2025-10918
High · 7.1
CWE-276 Nov 11, 2025
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4...
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk
CVE-2025-10986
Medium · 5.5
CWE-22 Oct 14, 2025
Path Traversal in Ivanti Endpoint Manager Mobile
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.
CVE-2025-10985
High · 7.2
CWE-78 Oct 14, 2025
OS Command Injection in Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10243
High · 7.2
CWE-78 Oct 14, 2025
OS Command Injection in Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10242
High · 7.2
CWE-78 Oct 14, 2025
OS Command Injection in Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-62392
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62391
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62390
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62389
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62388
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62387
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62386
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62385
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62384
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62383
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-11623
Medium · 6.5
CWE-89 Oct 13, 2025
SQL Injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-9713
High · 8.8
CWE-22 Oct 13, 2025
Path Traversal in Ivanti Endpoint Manager
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVE-2025-11622
High · 7.8
CWE-502 Oct 13, 2025
Deserialization of Untrusted Data in Ivanti Endpoint Manager
Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
CVE-2025-8712
Medium · 5.4
CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVE-2025-8711
Medium · 5.4
CWE-352 Sep 9, 2025
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.
CVE-2025-55148
High · 7.6
CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVE-2025-55147
High · 8.8
CWE-352 Sep 9, 2025
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is required
CVE-2025-55146
Medium · 4.9
CWE-252 Sep 9, 2025
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy...
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.
CVE-2025-55145
High · 8.9
CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.