Ivanti vulnerabilities

26 advisories tracked, 26 actively exploited. Last update: October 30, 2026.

By product: Connect Secure / Policy Secure / ZTA (8) · Endpoint Manager Mobile (EPMM) (7) · Sentry (1) · Endpoint Manager (EPM) (6) · Cloud Services Appliance (CSA) (5) · Virtual Traffic Manager (1) · Neurons (ITSM, Secure Access) (1)

• CVE-2026-111357October 30, 2026High 7Exploited
  Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
• CVE-2026-118527October 30, 2026Severity n/aExploited
  Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
• CVE-2026-104935October 13, 2026High 8.6Exploited
  Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
• CVE-2026-10520June 11, 2026Critical 10Exploited
  Ivanti Sentry OS Command Injection Vulnerability
• CVE-2026-6973May 7, 2026High 7.2Exploited
  Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
• CVE-2026-1340April 8, 2026Critical 9.8Exploited
  Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
• CVE-2026-1603March 9, 2026High 8.6Exploited
  Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
• CVE-2026-1281January 29, 2026Critical 9.8Exploited
  Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
• CVE-2025-4428May 19, 2025High 7.2Exploited
  Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
• CVE-2025-4427May 19, 2025Medium 5.3Exploited
  Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
• CVE-2025-22457April 4, 2025Critical 9Exploited
  Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
• CVE-2024-13161March 10, 2025Critical 9.8Exploited
  Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
• CVE-2024-13160March 10, 2025Critical 9.8Exploited
  Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
• CVE-2024-13159March 10, 2025Critical 9.8Exploited
  Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
• CVE-2025-0282January 8, 2025Critical 9Exploited
  Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
• CVE-2024-9380October 9, 2024High 7.2Exploited
  Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
• CVE-2024-9379October 9, 2024Medium 6.5Exploited
  Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
• CVE-2024-29824October 2, 2024High 8.8Exploited
  Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
• CVE-2024-7593September 24, 2024Critical 9.8Exploited
  Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
• CVE-2024-8963September 19, 2024Critical 9.4Exploited
  Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
• CVE-2024-8190September 13, 2024High 7.2Exploited
  Ivanti Cloud Services Appliance OS Command Injection Vulnerability
• CVE-2021-44529March 25, 2024Critical 9.8Exploited
  Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
• CVE-2024-21893January 31, 2024High 8.2Exploited
  Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2023-35082January 18, 2024Critical 9.8Exploited
  Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
• CVE-2024-21887January 10, 2024Critical 9.1Exploited
  Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
• CVE-2023-46805January 10, 2024High 8.2Exploited
  Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability