Vendor
ivanti
413 known vulnerabilities.
Products
Avalanche 92
Endpoint Manager 73
Connect Secure 65
Policy Secure 52
EPM 33
Endpoint Manager Mobile 25
Secure Access Client 15
ZTA Gateway 15
Neurons for Secure Access 13
EPMM 11
Workspace Control 10
Sentry 10
Xtraction 8
CSA (Cloud Services Appliance) 6
Cloud Services Application 6
Neurons for ITSM 5
ICS 5
IPS 5
ITSM 5
Wavelink 4
Neurons for ZTA gateways 3
DSM 3
Ivanti Neurons for ITSM 3
Neurons for ITSM (Cloud) 3
MobileIron Core 2
Ivanti Endpoint Manager 2
Neurons for ITSM (On-Premise) 2
Secure Access Client Windows 2
Desktop and Server Management 2
Secure Access Linux 2
Security Controls 2
Neurons for Secure 2
Automation 2
Docs@Work 1
LANDesk Management Suite 1
Connect Secure 22.7R2.9 1
Patch SDK 1
Patch for Configuration Manager 1
Neurons for Patch Management 1
Neurons Agent Platform 1
413 results · Feed
-
High 8.8
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticat…
-
High 8.8
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthent…
-
High 8.8
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attac…
-
High 7.8
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authent…
-
Medium 6.5
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authe…
-
High 7.2
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker wit…
-
High 7.8
A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privilege…
-
Medium 4.4
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local …
-
Critical 9.6
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to rea…
-
High 8.9
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unau…
-
High 7.0
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthentica…
-
High 7.4
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthe…
-
High 7.2
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenti…
KEV May 7, 2026 -
High 8.8CVE-2026-5786 EPSS 11%
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remot…
-
Medium 5.4
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information …
-
Medium 5.7
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker …
-
High 7.8
An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate the…
-
High 8.6
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to…
KEV Mar 9, 2026 -
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Apr 8, 2026 -
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Jan 29, 2026 -
High 7.8
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to…
-
High 7.1
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write…
-
High 8.8
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows …
-
Critical 9.6CVE-2025-10573 EPSS 34%
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute…
-
High 7.1
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticat…
-
Medium 4.7
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authen…
-
High 7.2CVE-2025-10985 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
High 7.2CVE-2025-10243 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
High 7.2CVE-2025-10242 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…
-
Medium 6.5
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitra…