Endpoint Manager (Ivanti) - vulnerabilities (CVEs)

116 CVEs, 0 in the last 30 days, 40 known versions, newest CVE from 2026-08-11. Vendor: Ivanti.

CVEs of Endpoint Manager

CVE-2026-18129 - CVSS 8.1 (high), 2026-08-11: Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a…
CVE-2026-18127 - CVSS 7.7 (high), 2026-08-11: External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over…
CVE-2026-18125 - CVSS 7.5 (high), 2026-08-11: An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
CVE-2026-8111 - CVSS 8.8 (high), 2026-05-12: SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
CVE-2026-8110 - CVSS 7.8 (high), 2026-05-12: Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their…
CVE-2026-8109 - CVSS 6.5 (medium), 2026-05-12: An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access…
CVE-2026-1603 - CVSS 8.6 (high), 2026-02-10: An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CVE-2026-1602 - CVSS 6.5 (medium), 2026-02-10: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-13661 - CVSS 8 (high), 2025-12-09: Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the…
CVE-2025-13662 - CVSS 7.8 (high), 2025-12-09: Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote…
CVE-2025-13659 - CVSS 8.8 (high), 2025-12-09: Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to…
CVE-2025-10573 - CVSS 9.6 (critical), 2025-12-09: Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of…
CVE-2025-10918 - CVSS 7.1 (high), 2025-11-11: Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files…
CVE-2025-62389 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62392 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62388 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62391 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62390 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62383 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62386 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62385 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62384 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62387 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-11623 - CVSS 6.5 (medium), 2025-10-13: SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-9713 - CVSS 8.8 (high), 2025-10-13: Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction…
CVE-2025-11622 - CVSS 7.8 (high), 2025-10-13: Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
CVE-2025-9872 - CVSS 8.8 (high), 2025-09-09: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote…
CVE-2025-9712 - CVSS 8.8 (high), 2025-09-09: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote…
CVE-2025-7037 - CVSS 7.2 (high), 2025-07-08: SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges…
CVE-2025-6996 - CVSS 8.4 (high), 2025-07-08: Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated…
CVE-2025-6995 - CVSS 8.4 (high), 2025-07-08: Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated…
CVE-2025-22459 - CVSS 4.8 (medium), 2025-04-08: Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to…
CVE-2025-22465 - CVSS 6.1 (medium), 2025-04-08: Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary…
CVE-2025-22464 - CVSS 6.1 (medium), 2025-04-08: An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local…
CVE-2025-22461 - CVSS 7.2 (high), 2025-04-08: SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to…
CVE-2025-22466 - CVSS 9.6 (critical), 2025-04-08: Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin…
CVE-2025-22458 - CVSS 7.8 (high), 2025-04-08: DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.
CVE-2024-13172 - CVSS 7.8 (high), 2025-01-14: Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote…
CVE-2024-13168 - CVSS 7.5 (high), 2025-01-14: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13171 - CVSS 7.8 (high), 2025-01-14: Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote…
CVE-2024-13170 - CVSS 7.5 (high), 2025-01-14: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13169 - CVSS 7.8 (high), 2025-01-14: An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated…
CVE-2024-13165 - CVSS 7.5 (high), 2025-01-14: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13164 - CVSS 7.8 (high), 2025-01-14: An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated…
CVE-2024-13167 - CVSS 7.5 (high), 2025-01-14: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13163 - CVSS 7.8 (high), 2025-01-14: Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote…
CVE-2024-13166 - CVSS 7.5 (high), 2025-01-14: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13158 - CVSS 7.2 (high), 2025-01-14: An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote…
CVE-2024-13161 - CVSS 9.8 (critical), 2025-01-14: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13160 - CVSS 9.8 (critical), 2025-01-14: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13159 - CVSS 9.8 (critical), 2025-01-14: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-13162 - CVSS 7.2 (high), 2025-01-14: SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with…
CVE-2024-10811 - CVSS 9.8 (critical), 2025-01-14: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated…
CVE-2024-10256 - CVSS 7.1 (high), 2024-12-10: Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.
CVE-2024-34782 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-37376 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-34781 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-34787 - CVSS 7.8 (high), 2024-11-13: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to…
CVE-2024-34780 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-34784 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-32839 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-32847 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-32844 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-32841 - CVSS 7.2 (high), 2024-11-13: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-50327 - CVSS 7.2 (high), 2024-11-12: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-50330 - CVSS 9.8 (critical), 2024-11-12: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to…
CVE-2024-50329 - CVSS 8.8 (high), 2024-11-12: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker…
CVE-2024-50328 - CVSS 7.2 (high), 2024-11-12: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-50323 - CVSS 7.8 (high), 2024-11-12: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to…
CVE-2024-50322 - CVSS 7.8 (high), 2024-11-12: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to…
CVE-2024-50326 - CVSS 7.2 (high), 2024-11-12: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…
CVE-2024-50324 - CVSS 7.2 (high), 2024-11-12: Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker…
CVE-2024-34783 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-34779 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-37397 - CVSS 8.2 (high), 2024-09-12: An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
CVE-2024-32848 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-34785 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-32840 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-32845 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-29847 - CVSS 10 (critical), 2024-09-12: Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to…
CVE-2024-32843 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-32842 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-32846 - CVSS 9.1 (critical), 2024-09-12: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
CVE-2024-8321 - CVSS 8.6 (high), 2024-09-10: Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate…
CVE-2024-8320 - CVSS 5.3 (medium), 2024-09-10: Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof…
CVE-2024-8441 - CVSS 6.7 (medium), 2024-09-10: An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin…
CVE-2024-8322 - CVSS 8.8 (high), 2024-09-10: Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access…
CVE-2024-8191 - CVSS 9.8 (critical), 2024-09-10: SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote…
CVE-2024-37381 - CVSS 8.4 (high), 2024-07-29: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute…
CVE-2024-29846 - CVSS 8.4 (high), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute…
CVE-2024-29830 - CVSS 8.4 (high), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute…
CVE-2024-29829 - CVSS 8.4 (high), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute…
CVE-2024-29825 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
CVE-2024-29828 - CVSS 8.4 (high), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute…
CVE-2024-29824 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
CVE-2024-29827 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
CVE-2024-29823 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
CVE-2024-29826 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
CVE-2024-22058 - CVSS 7.8 (high), 2024-05-31: A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in…
CVE-2024-29822 - CVSS 9.6 (critical), 2024-05-31: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…