Ivanti - vulnerabilities (CVEs)
525 CVEs in 78 products, 8 in the last 30 days, newest from 2026-10-15.
Products
- Connect Secure - 133 CVEs
- Avalanche - 117 CVEs
- Endpoint Manager - 116 CVEs
- Policy Secure - 78 CVEs
- Epm - 33 CVEs
- Endpoint Manager Mobile - 29 CVEs
- Workspace Control - 22 CVEs
- Secure Access Client - 21 CVEs
- Zero Trust Access Gateway - 17 CVEs
- Neurons For Secure Access - 15 CVEs
- Zta Gateway - 15 CVEs
- Neurons For Itsm - 14 CVEs
- Epmm - 11 CVEs
- Automation - 10 CVEs
- Xtraction - 8 CVEs
- Cloud Services Appliance - 7 CVEs
- Landesk Management Suite - 7 CVEs
- Csa Cloud Services Appliance - 6 CVEs
- Desktop & Server Management - 6 CVEs
- Endpoint Manager Cloud Services Appliance - 6 CVEs
- Sentry - 6 CVEs
- Cloud Services Application - 5 CVEs
- Ics - 5 CVEs
- Ips - 5 CVEs
- Itsm - 5 CVEs
- Neurons For Zero-trust Access - 5 CVEs
- Standalone Sentry - 4 CVEs
- Wavelink - 4 CVEs
- Dsm - 3 CVEs
- Incapptic Connect - 3 CVEs
- Ivanti Neurons For Itsm - 3 CVEs
- Neurons For Itsm Cloud - 3 CVEs
- Neurons For Zta Gateways - 3 CVEs
- Security Controls - 3 CVEs
- Application Control - 2 CVEs
- Desktop And Server Management - 2 CVEs
- Ivanti Endpoint Manager - 2 CVEs
- Mobileiron - 2 CVEs
- Mobileiron Core - 2 CVEs
- Neurons For Itsm On-premise - 2 CVEs
- Neurons For Secure - 2 CVEs
- Secure Access Client Windows - 2 CVEs
- Secure Access Linux - 2 CVEs
- Virtual Traffic Manager - 2 CVEs
- Application Control Engine - 1 CVEs
- Avlanche - 1 CVEs
- Connect Secure 22.7r2.9 - 1 CVEs
- Connect Secure Before - 1 CVEs
- Desktop&server Management - 1 CVEs
- Desktop Server Management Dsm - 1 CVEs
- Docs@work - 1 CVEs
- Docswork - 1 CVEs
- Dsm Netinst - 1 CVEs
- Dsm Remote - 1 CVEs
- Endpoint Security - 1 CVEs
- Mobileiron Sentry - 1 CVEs
- Neurons Agent Platform - 1 CVEs
- Neurons For Itsm On-prem - 1 CVEs
- Neurons For Itsm On-premises - 1 CVEs
- Neurons For Patch Management - 1 CVEs
- Neurons Patch For Intune - 1 CVEs
- Patch For Configuration Manager - 1 CVEs
- Patch Sdk - 1 CVEs
- Patch Software Development Kit - 1 CVEs
- Performance Manager - 1 CVEs
- Pulse Secure Desktop Client - 1 CVEs
- Pulse Secure Installer Service - 1 CVEs
- Secure Access - 1 CVEs
- Service Manager - 1 CVEs
- Service Manager Heat Remote Control - 1 CVEs
- Velocity License Server - 1 CVEs
- Virtual Application Delivery Controller - 1 CVEs
- Virtual Application Delivery Controllercwe-862 - 1 CVEs
- Vtm - 1 CVEs
- Management Center - 0 CVEs
- Mobileiron Mobile@work - 0 CVEs
- Virtual Traffic Management - 0 CVEs
- Zero Trust Access - 0 CVEs
Newest CVEs of Ivanti
- CVE-2026-111357 - CVSS 7 (high), 2026-10-15: Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…
- CVE-2026-109412 - CVSS 9.9 (critical), 2026-10-13: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
- CVE-2026-106047 - CVSS 7.7 (high), 2026-10-13: A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read…
- CVE-2026-106043 - CVSS 7.5 (high), 2026-10-13: A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create,…
- CVE-2026-106042 - CVSS 9.9 (critical), 2026-10-13: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect…
- CVE-2026-106035 - CVSS 5.5 (medium), 2026-10-13: An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to…
- CVE-2026-106034 - CVSS 5 (medium), 2026-10-13: A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the…
- CVE-2026-104935 - CVSS 8.6 (high), 2026-10-13: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
- CVE-2026-12647 - CVSS 9.9 (critical), 2026-09-08: A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12646 - CVSS 9.9 (critical), 2026-09-08: A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12645 - CVSS 9.9 (critical), 2026-09-08: A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-83527 - CVSS 8.1 (high), 2026-09-08: An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level…
- CVE-2026-12648 - CVSS 8.8 (high), 2026-09-08: A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
- CVE-2026-12650 - CVSS 9.9 (critical), 2026-09-08: A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
- CVE-2026-12651 - CVSS 8.8 (high), 2026-09-08: A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
- CVE-2026-12745 - CVSS 9.8 (critical), 2026-09-08: A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…
- CVE-2026-12744 - CVSS 9.8 (critical), 2026-09-08: A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…
- CVE-2026-18851 - CVSS 8.8 (high), 2026-09-08: Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate…
- CVE-2026-18129 - CVSS 8.1 (high), 2026-08-11: Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a…
- CVE-2026-18127 - CVSS 7.7 (high), 2026-08-11: External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over…
- CVE-2026-18125 - CVSS 7.5 (high), 2026-08-11: An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
- CVE-2026-14903 - CVSS 7.7 (high), 2026-07-14: Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902 - CVSS 6.1 (medium), 2026-07-14: An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
- CVE-2024-58352 - CVSS 8.7 (high), 2026-07-02: Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by…
- CVE-2026-10520 - CVSS 10 (critical), 2026-06-09: An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve…
- CVE-2026-10727 - CVSS 7.2 (high), 2026-06-09: An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute…
- CVE-2026-10523 - CVSS 9.9 (critical), 2026-06-09: An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to…
- CVE-2026-9614 - CVSS 8.8 (high), 2026-06-01: An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative…
- CVE-2026-8992 - CVSS 8.8 (high), 2026-05-22: An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary…
- CVE-2026-8111 - CVSS 8.8 (high), 2026-05-12: SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
