News stories · 30d
12
Advisories · 30d
0
Added to KEV · 90d
1
Actively exploited (CISA KEV)
| Added | CVE | Product | Vulnerability | Ransomware |
|---|---|---|---|---|
| 2026-10-13 | CVE-2026-104935 | Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | |
| 2026-06-11 | CVE-2026-10520 | Sentry | Ivanti Sentry OS Command Injection Vulnerability | |
| 2026-05-07 | CVE-2026-6973 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | |
| 2026-04-08 | CVE-2026-1340 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | |
| 2026-03-09 | CVE-2026-1603 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | |
| 2026-01-29 | CVE-2026-1281 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | |
| 2025-05-19 | CVE-2025-4428 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | |
| 2025-05-19 | CVE-2025-4427 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | |
| 2025-04-04 | CVE-2025-22457 | Connect Secure, Policy Secure, and ZTA Gateways | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | Known |
| 2025-03-10 | CVE-2024-13161 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| 2025-03-10 | CVE-2024-13160 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| 2025-03-10 | CVE-2024-13159 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| 2025-01-08 | CVE-2025-0282 | Connect Secure, Policy Secure, and ZTA Gateways | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | Known |
| 2024-10-09 | CVE-2024-9380 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | |
| 2024-10-09 | CVE-2024-9379 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | |
| 2024-10-02 | CVE-2024-29824 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | |
| 2024-09-24 | CVE-2024-7593 | Virtual Traffic Manager | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | |
| 2024-09-19 | CVE-2024-8963 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | |
| 2024-09-13 | CVE-2024-8190 | Cloud Services Appliance | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | |
| 2024-03-25 | CVE-2021-44529 | Endpoint Manager Cloud Service Appliance (EPM CSA) | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | Known |
| 2024-01-31 | CVE-2024-21893 | Connect Secure, Policy Secure, and Neurons | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | Known |
| 2024-01-18 | CVE-2023-35082 | Endpoint Manager Mobile (EPMM) and MobileIron Core | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability | Known |
| 2024-01-10 | CVE-2023-46805 | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | Known |
| 2024-01-10 | CVE-2024-21887 | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | Known |
| 2023-08-22 | CVE-2023-38035 | Sentry | Ivanti Sentry Authentication Bypass Vulnerability | Known |
CVEs in the news
Timeline (last 30 days)
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day — BleepingComputer, 2026-10-14
- CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records — The Record, 2026-10-14
- Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities — Security Affairs, 2026-10-14
- Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances — Help Net Security, 2026-10-14
- Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials — Cybersecurity News, 2026-10-14
- Ivanti Connect Secure Zero-Day Exploited in Attacks — Decipher +1 sources, 2026-10-14
- Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products — SecurityWeek, 2026-10-14
- Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day — CyberScoop, 2026-10-13
- Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far — The Hacker News, 2026-10-13
- Ivanti Connect Secure 0-Day Vulnerability Actively Exploited in the Wild — Cybersecurity News, 2026-10-13
- Ivanti warns of Connect Secure zero-day exploited in attacks — BleepingComputer +10 sources, 2026-10-13
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days — Volexity +1 sources, 2026-10-13