Ivanti Security Advisory · May 2026
IvantiScheduled
5
Total
Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.
1
Critical
CVEs with CVSS 9.0 or higher (critical per NVD scale).
1
Zero-day
Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).
1
KEV
Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.
1 zero-day / actively exploited
These vulnerabilities were exploited before or at the time the patch was released. Install the related updates first.
| Severity | CVE | Description | KB article | CVSS |
|---|---|---|---|---|
| High | CVE-2026-6973 | An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution. Listed in CISA KEV | — | 7.2 |
By product family
Unassigned4 CVEs
| Severity | CVE | Description | KB article | CVSS |
|---|---|---|---|---|
| Critical | CVE-2026-8043 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks. | — | 9.6 |
| High | CVE-2026-7432 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM | — | 7.8 |
| High | CVE-2026-8051 | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | — | 7.2 |
| Medium | CVE-2026-7431 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section. | — | 4.4 |