Ivanti Connect Secure vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
99 matching records
- UnknownIvanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityPatch nowKEVOct 30, 2026
- High7.0Ivanti Connect Secure and Policy Secure Inclusion of Functionality from Untrusted Control SpherePatch nowKEVEPSS 0.53%Oct 15, 2026
- Critical9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Check if you run itEPSS 0.87%Oct 13, 2026
- High7.7A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.Check if you run itEPSS 0.73%Oct 13, 2026
- High7.5A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.Check if you run itEPSS 0.66%Oct 13, 2026
- Critical9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generat…Check if you run itEPSS 0.79%Oct 13, 2026
- Medium5.5An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial…Check if you run itEPSS 0.31%Oct 13, 2026
- Medium5.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.Check if you run itEPSS 0.47%Oct 13, 2026
- High8.8Microsoft Windows Command Injection VulnerabilityPatch nowKEVEPSS 9.81%Oct 13, 2026
- High8.6Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityPatch nowKEVEPSS 86.77%Oct 13, 2026
- UnknownIvanti automation SQL Injection: HibernatePatch nowKEVEPSS 0.90%Jul 2, 2026
- Critical10.0Ivanti Sentry OS Command Injection VulnerabilityPatch nowKEVEPSS 99.91%Jun 9, 2026
- High8.8An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.Check if you run itEPSS 1.44%Jun 1, 2026
- High8.8An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.Check if you run itEPSS 0.56%May 22, 2026
- High8.8SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.Check if you run itEPSS 6.31%May 12, 2026
- High7.8Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.Check if you run itEPSS 0.24%May 12, 2026
- Medium6.5An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.Check if you run itEPSS 0.70%May 12, 2026
- High7.2OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.Check if you run itEPSS 1.91%May 12, 2026
- Critical9.6External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files…Check if you run itEPSS 0.87%May 12, 2026
- High7.0A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMCheck if you run itEPSS 0.28%May 12, 2026
- Medium4.4An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log…Check if you run itEPSS 0.18%May 12, 2026
- Critical9.1Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging t…Check if you run itEPSS 0.51%May 7, 2026
- Critical9.8An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.Check if you run itEPSS 0.82%May 7, 2026
- Critical9.1An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered S…Check if you run itEPSS 0.69%May 7, 2026
- High8.8An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.Check this weekEPSS 11.20%May 7, 2026