Vulnerabilidades de Ivanti
CVEs publicadas que afetam produtos de Ivanti: 99 registro(s), com severidade, exploração e correções.
Endpoint Manager 30Endpoint Manager Mobile 18Connect Secure 16Neurons For Itsm 8Xtraction 8Policy Secure 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4Sentry 3Neurons for ITSM (Cloud) 3Secure Access Client 3ICS 3IPS 3Neurons for ZTA gateways 2Neurons for ITSM (On-Premise) 2Standalone Sentry 2Virtual Traffic Manager 2EPMM 2Neurons For Zero-trust Access 2MobileIron Sentry 1Desktop & Server Management 1Cloud Services Appliance 1vTM 1EPM 1Neurons Patch for Intune 1Neurons for ITSM (On-Premises) 1Desktop and Server Management 1Zero Trust Access Gateway 1
CVE-2026-10520
Crítica · 10.0
KEV Urgente · 73 Exploit público CWE-78 09/06/2026
Ivanti Sentry OS Command Injection Vulnerability
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2026-9614
Alta · 8.8
CWE-284 01/06/2026
Improper Access Control em Ivanti Neurons for ITSM (On-Premises)
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
CVE-2026-8992
Alta · 8.8
CWE-295 22/05/2026
Improper Certificate Validation em Ivanti Secure Access Client
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
CVE-2026-8111
Alta · 8.8
CWE-89 12/05/2026
SQL Injection em Ivanti Endpoint Manager
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
CVE-2026-8110
Alta · 7.8
CWE-732 12/05/2026
Incorrect Permission Assignment for Critical Resource em Ivanti Endpoint Manager
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
CVE-2026-8109
Média · 6.5
CWE-749 12/05/2026
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version…
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
CVE-2026-8051
Alta · 7.2
CWE-78 12/05/2026
OS Command Injection em Ivanti Virtual Traffic Manager
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2026-8043
Crítica · 9.6
CWE-73 12/05/2026
External control of a file name in Ivanti Xtraction before version 2026.2 allows a…
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
CVE-2026-7432
Alta · 7.0
CWE-362 12/05/2026
Race Condition em Ivanti Secure Access Client
A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
CVE-2026-7431
Média · 4.4
CWE-732 12/05/2026
Incorrect Permission Assignment for Critical Resource em Ivanti Secure Access Client
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
CVE-2026-7821
Crítica · 9.1
CWE-295 07/05/2026
Improper Certificate Validation em Ivanti Endpoint Manager Mobile
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
CVE-2026-6973
Alta · 7.2
KEV Alta · 54 CWE-20 07/05/2026
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-5788
Crítica · 9.8
CWE-284 07/05/2026
Improper Access Control em Ivanti Endpoint Manager Mobile
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
CVE-2026-5787
Crítica · 9.1
CWE-295 07/05/2026
Improper Certificate Validation em Ivanti Endpoint Manager Mobile
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
CVE-2026-5786
Alta · 8.8
CWE-284 07/05/2026
Improper Access Control em Ivanti Endpoint Manager Mobile
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
CVE-2026-4914
Média · 5.4
CWE-79 14/04/2026
Cross-site Scripting (XSS) em Ivanti Neurons for ITSM (On-Premise)
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.
CVE-2026-4913
Média · 5.7
CWE-424 14/04/2026
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a…
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.
CVE-2026-3483
Alta · 7.8
CWE-749 10/03/2026
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local…
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.
CVE-2026-1602
Média · 6.5
CWE-89 10/02/2026
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2026-1603
Alta · 7.5
KEV Alta · 63 Exploit público CWE-306 10/02/2026
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CVE-2026-1281
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-1340
Crítica · 9.8
KEV Urgente · 79 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2025-13662
Alta · 7.8
CWE-347 09/12/2025
Improper Verification of Cryptographic Signature em Ivanti Endpoint Manager
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
CVE-2025-13661
Alta · 8.0
CWE-22 09/12/2025
Path Traversal em Ivanti Endpoint Manager
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
CVE-2025-13659
Alta · 8.8
CWE-913 09/12/2025
Improper Control of Dynamically-Managed Code Resources em Ivanti Endpoint Manager
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.