Vendor
Ivanti
530 known vulnerabilities in products by Ivanti, 36 of them actively exploited (CISA KEV).
Key figures
530
Vulnerabilities
36
Actively exploited (KEV)
12
Used by ransomware
164
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability In CISA KEVRansomware | 9.1 | |
| Critical | CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability In CISA KEVRansomware | 9.9 | |
| Critical | CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability In CISA KEVRansomware | 8.2 | |
| Critical | CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability In CISA KEVRansomware | 8.2 | |
| Critical | CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability In CISA KEV | 8.6 | |
| Critical | CVE-2026-10520 | Ivanti Sentry OS Command Injection Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2019-11539 | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability In CISA KEVRansomware | 8.0 | |
| Critical | CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability In CISA KEV | 8.6 | |
| Critical | CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-13161 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-7593 | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-29824 | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability In CISA KEV | 9.4 | |
| Critical | CVE-2025-4428 | Remote Code Execution In CISA KEV | 7.2 | |
| Critical | CVE-2024-8190 | Ivanti Cloud Services Appliance OS Command Injection Vulnerability In CISA KEV | 7.2 |
News
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdlesdarkreading,
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attemptsthehackernews,
- Hackers abuse the Ivanti Connect Secure bug to gain access without accountscsoonline,
- Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)cert-fr,
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNsecurityweek,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,