Ivanti Connect Secure vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
99 matching records
- High7.2Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityPatch nowKEVEPSS 34.45%May 7, 2026
- Medium5.4Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions.Check if you run itEPSS 0.34%Apr 14, 2026
- Medium5.7Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.Check if you run itEPSS 0.59%Apr 14, 2026
- High7.8An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Check if you run itEPSS 0.41%Mar 10, 2026
- High7.5Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityPatch nowKEVEPSS 88.33%Feb 10, 2026
- Critical9.8Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityPatch nowKEVEPSS 98.64%Jan 29, 2026
- Critical9.8Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityPatch nowKEVEPSS 98.69%Jan 29, 2026
- High7.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attackeCheck if you run itEPSS 0.58%Dec 9, 2025
- High7.1Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory.Check if you run itEPSS 1.36%Dec 9, 2025
- High8.8Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files oCheck if you run itEPSS 1.96%Dec 9, 2025
- Critical9.6Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator sessCheck this weekEPSS 33.50%Dec 9, 2025
- High7.1Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on diskCheck if you run itEPSS 0.24%Nov 11, 2025
- Medium4.7Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintCheck if you run itEPSS 0.62%Oct 14, 2025
- Medium6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.Check if you run itEPSS 0.83%Oct 13, 2025
- Medium6.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.Check if you run itEPSS 0.82%Oct 13, 2025
- Medium5.4Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for SecureCheck if you run itEPSS 0.45%Sep 9, 2025
- Medium5.5Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and IvaCheck if you run itEPSS 0.36%Aug 12, 2025
- Medium4.9XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.Check if you run itEPSS 0.68%Aug 12, 2025
- High7.5A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons forCheck if you run itEPSS 1.14%Aug 12, 2025
- High7.5A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti NeuronsCheck if you run itEPSS 1.12%Aug 12, 2025
- Medium6.5Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accountsCheck if you run itEPSS 0.83%Aug 12, 2025
- High7.2Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code executionCheck if you run itEPSS 1.26%Aug 12, 2025
- High7.2SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries.Check if you run itEPSS 1.13%Aug 12, 2025
- Medium4.9A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web reCheck if you run itEPSS 0.98%Jul 12, 2025
- Critical9.0A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.Check if you run itEPSS 0.59%Jul 12, 2025