Ivanti vulnerabilities
We track 301 vulnerabilities in Ivanti products across 53 products. 300 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Ivanti vulnerabilities
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Endpoint Manager: Use of Uninitialized Resource
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
- 7.8 High severity
Endpoint Manager: Deserialization of Untrusted Data
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.2 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.8 Critical severity
Avalanche: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
- 7.5 High severity
Avalanche: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011.
- 7.5 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.0 High severity
Application Control Engine: Race Condition within a Thread
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
- 7.0 High severity
Connect Secure: Out-of-bounds Write
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
- 9.0 Critical severity
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Exploited
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
- 7.5 High severity
Connect Secure: Out-of-bounds Read
An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Connect Secure: Out-of-bounds Write
A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Automation: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation.
- 7.8 High severity
Workspace Control: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.
- 7.8 High severity
Application Control: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation.
- 7.8 High severity
Performance Manager: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation.
- 7.8 High severity
Security Controls: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation.
- 8.8 High severity
Connect Secure: Client-Side Enforcement of Server-Side Security
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.
- 7.2 High severity
Cloud Services Application: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- 7.2 High severity
Cloud Services Application: Improper Neutralization of Special Elements used in a Command
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Connect Secure: Improper Neutralization of Special Elements used in a Command
Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)
- 7.2 High severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
Connect Secure: Incorrect Permission Assignment for Critical Resource
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.5 High severity
Connect Secure: Out-of-bounds Read
An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Connect Secure: Out-of-bounds Read
An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
EPM: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.