Ivanti Connect Secure known exploited vulnerabilities
We track 14 CVEs in Ivanti Connect Secure. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2026). CISA flags 8 of them as used in ransomware campaigns. The most recent is CVE-2026-104935, added to KEV on .
Also listed as: Connect Secure and Policy Secure · Connect Secure, Policy Secure, and Neurons · Connect Secure, Policy Secure, and ZTA Gateways · Pulse Connect Secure · Pulse Connect Secure and Pulse Policy Secure. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 14
- On CISA KEV
- 14
- Ransomware use
- 8
- Rated critical
- 5
Every Ivanti Connect Secure CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofingwrite-up | [ HIGH ] | 8.6 | 26.0% | ||
| CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | ||
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | ||
| CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 8.2 | 100.0% | ||
| CVE-2024-21887 Ivanti Connect Secure / Policy Secure Command Injectionransomware usewrite-up | [ CRITICAL ] | 9.1 | 100.0% | ||
| CVE-2023-46805 Ivanti Connect Secure / Policy Secure Authentication Bypassransomware usewrite-up | [ HIGH ] | 8.2 | 100.0% | ||
| CVE-2021-22900 Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | [ HIGH ] | 7.2 | 14.1% | ||
| CVE-2021-22899 Ivanti Pulse Connect Secure Command Injection Vulnerability | [ HIGH ] | 8.8 | 22.9% | ||
| CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | [ HIGH ] | 8.8 | 41.3% | ||
| CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-Free Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 47.2% | ||
| CVE-2020-8260 Ivanti Pulse Connect Secure Code Execution Vulnerability | [ HIGH ] | 7.2 | 96.5% | ||
| CVE-2020-8243 Ivanti Pulse Connect Secure Code Execution Vulnerability | [ HIGH ] | 7.2 | 90.8% | ||
| CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerabilityransomware use | [ HIGH ] | 7.2 | 98.5% | ||
| CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 100.0% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/ivanti.json.
Our Ivanti Connect Secure coverage
Other Ivanti products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.