Vendor
ivanti
413 known vulnerabilities.
ivanti at a glance
8 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 14 | 2 |
| Oct 2026 | 8 | 2 |
| Sep 2026 | 10 | 6 |
| Aug 2026 | 3 | 0 |
| Jul 2026 | 2 | 0 |
| Jun 2026 | 4 | 2 |
| May 2026 | 13 | 1 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 2 | 0 |
| Jan 2026 | 2 | 2 |
| Dec 2025 | 4 | 1 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 17 | 0 |
| Sep 2025 | 13 | 0 |
| Aug 2025 | 7 | 0 |
| Jul 2025 | 15 | 2 |
| Jun 2025 | 3 | 0 |
| May 2025 | 4 | 1 |
| Apr 2025 | 8 | 1 |
| Mar 2025 | 1 | 0 |
| Feb 2025 | 10 | 4 |
| Jan 2025 | 22 | 5 |
| Dec 2024 | 16 | 5 |
Most common weaknesses
Products
Latest advisories
-
High max 9.8NCSC-2026-0493 2 CVEs
Kwetsbaarheden verholpen in Ivanti Endpoint Manager
Ivanti heeft twee kwetsbaarheden in Ivanti Endpoint Manager verholpen, die betrekking hebben op de Core- en Agent-componenten.
-
High max 9.4WID-SEC-2026-4503 1 CVE
Ivanti Cloud Services Application: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ivanti Cloud Services Application ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
-
Medium max 7.2WID-SEC-2026-4505 4 CVEs
Ivanti Sentry: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Ivanti Sentry ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen und um Dateien zu manipulieren.
-
High max 9.8WID-SEC-2026-4512 2 CVEs
Ivanti Endpoint Manager: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager ausnutzen, um beliebigen Programmcode auszuführen und Daten offenzulegen oder zu manipulieren.
-
Medium max 7.2WID-SEC-2026-4513 6 CVEs
Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren oder Informationen auszulesen.
413 results · Feed
-
Medium 4.9
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker…
-
Medium 5.5
An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authentic…
-
Medium 4.9
Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attac…
-
Medium 4.9
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 6.7
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 5.5
A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated …
-
Medium 5.5
An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 1…
-
Medium 6.7
Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with…
-
High 7.2CVE-2026-105425 Public exploit
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versi…
-
Critical 9.4
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to a…
-
Medium 6.8
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows …
-
Critical 9.8CVE-2026-121653 Public exploit
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker t…
-
Medium 6.3
Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to…
-
Medium 4.3CVE-2026-118527 Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…
KEV Oct 30, 2026 -
High 7.0CVE-2026-111357 Exploited
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, l…
KEV Oct 30, 2026 -
Critical 9.9
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensiti…
-
High 7.7
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a …
-
High 7.5
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote …
-
Critical 9.9
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authen…
-
Medium 5.5
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a r…
-
Medium 5.0
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to crea…
-
High 8.6
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute ar…
KEV Oct 13, 2026 -
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
High 8.1
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated at…
-
High 8.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticate…
-
Critical 9.9
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticate…
-
High 8.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticate…
-
Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica…
-
Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica…
-
High 8.8
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remot…
-
High 8.1
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a…
-
High 7.7
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authentic…
-
High 7.5
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated a…
-
High 7.7
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary fi…
-
Medium 4.0
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users…
-
High 7.2CVE-2026-10727 EPSS 13%
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote au…
-
Critical 9.9
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allo…
-
Critical 10.0
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote…
KEV Jun 11, 2026