Ivanti vulnerabilities
We track 301 vulnerabilities in Ivanti products across 53 products. 300 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Ivanti vulnerabilities
- 9.4 Critical severity
Cloud Services Application: Missing Authentication for Critical Functionality
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- 9.8 Critical severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- 7.2 High severity
Sentry: Improper Neutralization of Special Elements used in an OS Command
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 4.3 Medium severity
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- 7.0 High severity
Ivanti Connect Secure Missing Authentication for Critical Function Exploited
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
- 7.7 High severity
Xtraction: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
- 7.5 High severity
Xtraction: Missing Authentication for Critical Functionality
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
- 9.9 Critical severity
Xtraction: External Control of File Name or Path
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmit
- 8.6 High severity
Ivanti Connect Secure Authentication Bypass by Spoofing Exploited
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- 8.1 High severity
Sentry: Authentication Bypass Using an Alternate Path or Channel
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
- 8.8 High severity
Endpoint Manager Mobile: Missing Authorization
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
- 9.8 Critical severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- 9.8 Critical severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Ivanti Neurons for ITSM: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Ivanti Neurons for ITSM: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.8 High severity
Ivanti Neurons for ITSM: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- 8.1 High severity
Endpoint Manager: Improper Certificate Validation
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
- 7.7 High severity
Endpoint Manager: External Control of File Name or Path
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Read
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root
- 9.8 Critical severity
Sentry: Authentication Bypass Using an Alternate Path or Channel
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
- 10.0 Critical severity
Ivanti Sentry OS Command Injection Exploited
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
- 8.8 High severity
Neurons for ITSM (On-Premises): Improper Access Control
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
- 8.8 High severity
Secure Access Client: Improper Certificate Validation
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
- 8.8 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
- 7.8 High severity
Endpoint Manager: Incorrect Permission Assignment for Critical Resource
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
- 7.2 High severity
Virtual Traffic Manager: Improper Neutralization of Special Elements used in an OS Command
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.6 Critical severity
Xtraction: External Control of File Name or Path
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- 9.1 Critical severity
Endpoint Manager Mobile: Improper Certificate Validation
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM applia
- 7.2 High severity
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Exploited
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
- 9.8 Critical severity
Endpoint Manager Mobile: Improper Access Control
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
- 9.1 Critical severity
Endpoint Manager Mobile: Improper Certificate Validation
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
- 8.8 High severity
Endpoint Manager Mobile: Improper Access Control
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Authentication Bypass Exploited
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
- 9.8 Critical severity
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Exploited
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- 9.8 Critical severity
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Exploited
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.