Ivanti vulnerabilities
Coverage of Ivanti Connect Secure, Policy Secure, and related edge VPN appliance vulnerabilities — a recurring target for nation-state and ransomware actors alike.
We track 40 Ivanti CVEs, 38 of them on CISA's Known Exploited Vulnerabilities catalog (12 flagged for ransomware use). The latest KEV addition is CVE-2026-118527, added .
- CVEs tracked
- 40
- On CISA KEV
- 38
- Ransomware use
- 12
- Rated critical
- 20
Most-exploited Ivanti products
Latest Ivanti coverage
Our reporting filed under Ivanti, plus any story that cites one of its CVEs.
Ivanti Connect Secure Chain Fixes Ship, KEV Due Nov 2
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Fixes for the full exploited chain are now out in 25.1.1.3 and 22.8R2.6.
CISA: 105 Attacks Confirm Ivanti Patch Is Urgent
CISA cites 105 honeypot-logged exploit attempts and urges immediate patching of CVE-2026-104935 in Ivanti Connect Secure. Oct 16 deadline is 24 hours out.
Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17
CVE-2026-0322, a PAN-OS code injection flaw, is confirmed exploited in attacks. CISA added it to KEV with an October 17 remediation deadline.
Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday
Fortinet, Citrix, and Ivanti each released October patches today, closing 29 vulnerabilities including critical-severity flaws in edge network products.
Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16
Ivanti has patched CVE-2026-104935, an authentication bypass in Connect Secure actively exploited in a three-zero-day chain. CISA deadline: October 16.
Ivanti Patches Critical RCE in Neurons, EPMM, Sentry
Ivanti's September 2026 patches close six critical RCEs in Neurons for ITSM and authentication bypass flaws in Sentry and EPMM. Patch now.
Known exploited Ivanti vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-118527 Ivanti Connect Secure Predictable Identifier File Uploadwrite-up | [ UNKNOWN ] | — | 0.8% | ||
| CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerabilitywrite-up | [ HIGH ] | 7.0 | 0.5% | ||
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofingwrite-up | [ HIGH ] | 8.6 | 88.9% | ||
| CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability | [ CRITICAL ] | 10.0 | 99.9% | ||
| CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | [ HIGH ] | 7.2 | 34.5% | ||
| CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | [ CRITICAL ] | 9.8 | 98.6% | ||
| CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | [ HIGH ] | 8.6 | 88.3% | ||
| CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | [ CRITICAL ] | 9.8 | 98.7% | ||
| CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | [ HIGH ] | 7.2 | 88.0% | ||
| CVE-2025-4427 Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | [ MEDIUM ] | 5.3 | 99.9% | ||
| CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | ||
| CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | [ CRITICAL ] | 9.8 | 89.8% | ||
| CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | [ CRITICAL ] | 9.8 | 91.0% | ||
| CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | ||
| CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | [ HIGH ] | 7.2 | 58.3% | ||
| CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | [ MEDIUM ] | 6.5 | 44.3% | ||
| CVE-2024-29824 Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | [ HIGH ] | 8.8 | 99.9% | ||
| CVE-2024-7593 Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | [ CRITICAL ] | 9.4 | 98.6% | ||
| CVE-2024-8190 Ivanti Cloud Services Appliance OS Command Injection Vulnerability | [ HIGH ] | 7.2 | 88.5% | ||
| CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability ransomware use | [ CRITICAL ] | 9.8 | 99.1% | ||
| CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 8.2 | 100.0% | ||
| CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2024-21887 Ivanti Connect Secure / Policy Secure Command Injectionransomware usewrite-up | [ CRITICAL ] | 9.1 | 100.0% | ||
| CVE-2023-46805 Ivanti Connect Secure / Policy Secure Authentication Bypassransomware usewrite-up | [ HIGH ] | 8.2 | 100.0% | ||
| CVE-2023-38035 Ivanti Sentry Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | [ HIGH ] | 7.2 | 63.6% | ||
| CVE-2023-35078 Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2021-22900 Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | [ HIGH ] | 7.2 | 14.1% | ||
| CVE-2021-22899 Ivanti Pulse Connect Secure Command Injection Vulnerability | [ HIGH ] | 8.8 | 22.9% | ||
| CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | [ HIGH ] | 8.8 | 41.3% | ||
| CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-Free Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 47.5% | ||
| CVE-2020-8260 Ivanti Pulse Connect Secure Code Execution Vulnerability | [ HIGH ] | 7.2 | 96.5% | ||
| CVE-2020-8243 Ivanti Pulse Connect Secure Code Execution Vulnerability | [ HIGH ] | 7.2 | 90.8% | ||
| CVE-2020-15505 Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 99.7% | ||
| CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerabilityransomware use | [ HIGH ] | 7.2 | 98.5% | ||
| CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 100.0% |
Every Ivanti CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Other Ivanti CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-109412 Ivanti Neurons Patch for Intune Authentication Information Leakwrite-up | [ CRITICAL ] | 9.9 | 0.9% | — |
| CVE-2026-106042 Ivanti Xtraction Application Request Redirect and Credential Capturewrite-up | [ CRITICAL ] | 9.9 | 0.8% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/ivanti.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.