CVE Intelligence

Ivanti vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ivanti products: 110 record(s), with severity, exploitation and fixes.

Endpoint Manager 30Connect Secure 27Policy Secure 19Endpoint Manager Mobile 18Zero Trust Access Gateway 12Neurons For Secure Access 11ZTA Gateway 11Neurons For Itsm 8Xtraction 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4ICS 3Neurons for ITSM (Cloud) 3Secure Access Client 3IPS 3Sentry 3EPMM 2Virtual Traffic Manager 2Standalone Sentry 2Neurons for ITSM (On-Premise) 2Neurons For Zero-trust Access 2Neurons for ZTA gateways 2Connect Secure before 1Connect Secure 22.7R2.9 1Neurons for Secure 1Desktop and Server Management 1Neurons for ITSM (On-Premises) 1Neurons Patch for Intune 1Desktop & Server Management 1MobileIron Sentry 1Cloud Services Appliance 1vTM 1EPM 1

Exploited only (KEV) →

CVE-2025-55144 Medium · 5.4 CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVE-2025-55143 Medium · 6.1 CWE-79 Sep 9, 2025
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.
CVE-2025-55142 High · 8.8 CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-55141 High · 8.8 CWE-862 Sep 9, 2025
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-55139 Medium · 6.8 CWE-918 Sep 9, 2025
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.
CVE-2025-4427 High · 7.5 KEV Urgent · 79 Public exploit CWE-288 May 13, 2025
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
CVE-2025-4428 High · 8.8 KEV Urgent · 77 Public exploit CWE-94 May 13, 2025
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVE-2025-22457 Critical · 9.8 KEV Urgent · 88 Public exploit Ransomware CWE-787 Apr 3, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-13159 High · 7.5 KEV High · 69 Public exploit CWE-36 Jan 14, 2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13160 High · 7.5 KEV High · 63 Public exploit CWE-36 Jan 14, 2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13161 High · 7.5 KEV High · 63 Public exploit CWE-36 Jan 14, 2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2025-0282 Critical · 9.0 KEV Urgent · 88 Public exploit Ransomware CWE-787 Jan 8, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-9379 High · 7.2 KEV High · 56 CWE-89 Oct 8, 2024
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVE-2024-9380 High · 7.2 KEV High · 56 CWE-78 Oct 8, 2024
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVE-2024-8963 Critical · 9.1 KEV Urgent · 73 Public exploit CWE-22 Sep 19, 2024
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVE-2024-8190 High · 7.2 KEV High · 62 Public exploit CWE-78 Sep 10, 2024
Ivanti Cloud Services Appliance OS Command Injection Vulnerability
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
CVE-2024-7593 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-287 Aug 13, 2024
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVE-2024-29824 High · 8.8 KEV Urgent · 79 Public exploit CWE-89 May 31, 2024
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVE-2024-21893 High · 8.2 KEV Urgent · 89 Public exploit Ransomware CWE-918 Jan 31, 2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-21887 Critical · 9.1 KEV Urgent · 90 Public exploit Ransomware CWE-77 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805 High · 8.2 KEV Urgent · 99 Public exploit Ransomware CWE-287 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-38035 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-863 Aug 21, 2023
Ivanti Sentry Authentication Bypass Vulnerability
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-35082 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Aug 15, 2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2023-35081 High · 7.2 KEV High · 56 CWE-22 Aug 3, 2023
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
CVE-2023-35078 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 25, 2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.