Ivanti Connect Secure security vulnerabilities
VPN. Public CVE monitoring for Ivanti Connect Secure. Vendor security advisories are linked on this page.
Built for VPN and endpoint administrators.
99 public records · 0 security-fix timeline events. 1 published in the last 7 days. 68 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 2
- High 5
- Medium 2
- Low 0
2026-08-049 issues2026-11-01
Known exploited
View all known exploited- High7.5Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass VulnerabilityPatch nowKEVEPSS 99.93%May 13, 2025
- Critical10.0Ivanti Sentry OS Command Injection VulnerabilityPatch nowKEVEPSS 99.91%Jun 9, 2026
- Critical9.8Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityPatch nowKEVEPSS 98.69%Jan 29, 2026
- Critical9.8Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityPatch nowKEVEPSS 98.64%Jan 29, 2026
- High7.5Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityPatch nowKEVEPSS 88.33%Feb 10, 2026
- High8.8Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityPatch nowKEVEPSS 88.00%May 13, 2025
- High8.6Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityPatch nowKEVEPSS 86.77%Oct 13, 2026
- High7.2Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityPatch nowKEVEPSS 34.45%May 7, 2026
Recently published
Browse catalog- High7.0Ivanti Connect Secure and Policy Secure Inclusion of Functionality from Untrusted Control SpherePatch nowKEVEPSS 0.53%Oct 15, 2026
- Critical9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Check if you run itEPSS 0.87%Oct 13, 2026
- High7.7A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.Check if you run itEPSS 0.73%Oct 13, 2026
- High7.5A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.Check if you run itEPSS 0.66%Oct 13, 2026
- Medium5.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.Check if you run itEPSS 0.47%Oct 13, 2026
- High8.8Microsoft Windows Command Injection VulnerabilityPatch nowKEVEPSS 9.81%Oct 13, 2026
- High8.6Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityPatch nowKEVEPSS 86.77%Oct 13, 2026
- Critical10.0Ivanti Sentry OS Command Injection VulnerabilityPatch nowKEVEPSS 99.91%Jun 9, 2026
- High8.8An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.Check if you run itEPSS 1.44%Jun 1, 2026
- High8.8An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.Check if you run itEPSS 0.56%May 22, 2026