Ivanti vulnerabilities
We track 301 vulnerabilities in Ivanti products across 53 products. 300 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Ivanti vulnerabilities
- 8.0 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
- 8.8 High severity
Endpoint Manager: Improper Control of Dynamically-Managed Code Resources
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is
- 7.1 High severity
Endpoint Manager: Incorrect Default Permissions
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 8.8 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 8.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 8.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 7.6 High severity
Connect Secure: Missing Authorization
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticat
- 8.8 High severity
Connect Secure: Cross-Site Request Forgery
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to
- 8.9 High severity
Connect Secure 22.7R2.9: Missing Authorization
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticat
- 8.8 High severity
Connect Secure: Missing Authorization
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticat
- 8.8 High severity
Connect Secure: Missing Authorization
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticat
- 8.8 High severity
Virtual Application Delivery ControllerCWE-862: Missing Authorization
Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password
- 7.2 High severity
Avalanche: Unrestricted Upload of File with Dangerous Type
Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution
- 7.2 High severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution
- 7.5 High severity
Connect Secure: Heap-based Buffer Overflow
A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote una
- 7.5 High severity
Connect Secure: Out-of-bounds Read
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote
- 9.8 Critical severity
Avalanche: Buffer Copy without Checking Size of Input
A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 7.2 High severity
Endpoint Manager Mobile: Improper Neutralization of Special Elements used in an OS Command
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution
- 7.3 High severity
Workspace Control: Use of Hard-coded Cryptographic Key
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password.
- 8.8 High severity
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Exploited
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
- 7.5 High severity
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Exploited
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
- 9.8 Critical severity
Neurons for ITSM (on-prem): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.
- 9.6 Critical severity
Endpoint Manager: Improper Neutralization of Input During Web Page Generation
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.
- 9.8 Critical severity
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Exploited
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
- 7.8 High severity
Secure Access Client: Incorrect Permission Assignment for Critical Resource
Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
- 8.8 High severity
Connect Secure: Stack-based Buffer Overflow
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution.
- 7.2 High severity
Cloud Services Application: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Connect Secure: Improper Control of Generation of Code
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Endpoint Manager: Out-of-bounds Read
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.