Ivanti vulnerabilities
We track 301 vulnerabilities in Ivanti products across 53 products. 300 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Ivanti vulnerabilities
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.1 High severity
Secure Access Client: Privilege Defined With Unsafe Actions
Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.
- 7.2 High severity
Connect Secure: Improper Neutralization of Special Elements used in an OS Command
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code executio
- 7.2 High severity
Connect Secure: Improper Neutralization of Special Elements used in an OS Command
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code executio
- 8.8 High severity
Connect Secure: Use After Free
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution
- 7.5 High severity
Connect Secure: NULL Pointer Dereference
A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Avalanche: Out-of-bounds Read
An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory.
- 9.8 Critical severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution.
- 8.8 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- 7.8 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- 7.5 High severity
Connect Secure: Out-of-bounds Write
A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Connect Secure: Untrusted Search Path
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.
- 7.2 High severity
Connect Secure: Improper Neutralization of Special Elements used in an OS Command
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code executio
- 7.8 High severity
DSM: Incorrect Authorization
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
- 7.8 High severity
DSM: Incorrect Authorization
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
- 7.2 High severity
Ivanti Cloud Services Appliance (CSA) OS Command Injection Exploited
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
- 7.2 High severity
Ivanti Cloud Services Appliance (CSA) SQL Injection Exploited
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- 7.8 High severity
Velocity License Server: Incorrect Default Permissions
Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local privilege escalation.
- 7.5 High severity
Avalanche: NULL Pointer Dereference
A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service.
- 9.1 Critical severity
Ivanti Cloud Services Appliance (CSA) Path Traversal Exploited
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
- 8.2 High severity
EPM: Improper Restriction of XML External Entity Reference
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.