Ivanti
36 CVEs in CISA KEV — 12 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2024-7593 |
Virtual Traffic Manager | — | 1.0000 | 2024-09-24 | 2024-10-15 | Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability t | |
CVE-2024-21893 |
Connect Secure, Policy Secure, and Neurons | — | 1.0000 | 2024-01-31 | 2024-02-02 | RW | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Poli |
CVE-2023-35082 |
Endpoint Manager Mobile (EPMM) and MobileIron Core | — | 1.0000 | 2024-01-18 | 2024-02-08 | RW | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authenticat |
CVE-2024-21887 |
Connect Secure and Policy Secure | — | 1.0000 | 2024-01-10 | 2024-01-22 | RW | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti P |
CVE-2023-35078 |
Endpoint Manager Mobile (EPMM) | — | 1.0000 | 2023-07-25 | 2023-08-15 | RW | Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contai |
CVE-2024-13159 |
Endpoint Manager (EPM) | — | 0.9999 | 2025-03-10 | 2025-03-31 | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability | |
CVE-2023-46805 |
Connect Secure and Policy Secure | — | 0.9998 | 2024-01-10 | 2024-01-22 | RW | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti P |
CVE-2025-22457 |
Connect Secure, Policy Secure, and ZTA Gateways | — | 0.9998 | 2025-04-04 | 2025-04-11 | RW | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based bu |
CVE-2025-0282 |
Connect Secure, Policy Secure, and ZTA Gateways | — | 0.9998 | 2025-01-08 | 2025-01-15 | RW | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buf |
CVE-2023-38035 |
Sentry | — | 0.9995 | 2023-08-22 | 2023-09-12 | RW | Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication b |
CVE-2024-29824 |
Endpoint Manager (EPM) | — | 0.9994 | 2024-10-02 | 2024-10-23 | Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core ser | |
CVE-2025-4427 |
Endpoint Manager Mobile (EPMM) | — | 0.9993 | 2025-05-19 | 2025-06-09 | Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerab | |
CVE-2026-10520 |
Sentry | — | 0.9991 | 2026-06-11 | 2026-06-14 | Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injec | |
CVE-2026-1281 |
Endpoint Manager Mobile (EPMM) | — | 0.9869 | 2026-01-29 | 2026-02-01 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability th | |
CVE-2026-1340 |
Endpoint Manager Mobile (EPMM) | — | 0.9864 | 2026-04-08 | 2026-04-11 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability th | |
CVE-2024-8963 |
Cloud Services Appliance (CSA) | — | 0.9861 | 2024-09-19 | 2024-10-10 | Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability th | |
CVE-2024-13160 |
Endpoint Manager (EPM) | — | 0.9099 | 2025-03-10 | 2025-03-31 | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability | |
CVE-2024-13161 |
Endpoint Manager (EPM) | — | 0.8981 | 2025-03-10 | 2025-03-31 | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability | |
CVE-2024-8190 |
Cloud Services Appliance | — | 0.8853 | 2024-09-13 | 2024-10-04 | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerabi | |
CVE-2026-1603 |
Endpoint Manager (EPM) | — | 0.8833 | 2026-03-09 | 2026-03-23 | Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alterna | |
CVE-2025-4428 |
Endpoint Manager Mobile (EPMM) | — | 0.8800 | 2025-05-19 | 2025-06-09 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in | |
CVE-2026-104935 |
Connect Secure | — | 0.8677 | 2026-10-13 | 2026-10-16 | Ivanti Connect Secure contains an authentication bypass by spoofing vulnerabilit | |
CVE-2023-35081 |
Endpoint Manager Mobile (EPMM) | — | 0.6358 | 2023-07-31 | 2023-08-21 | Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability th | |
CVE-2024-9380 |
Cloud Services Appliance (CSA) | — | 0.5832 | 2024-10-09 | 2024-10-30 | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerabi | |
CVE-2024-9379 |
Cloud Services Appliance (CSA) | — | 0.4427 | 2024-10-09 | 2024-10-30 | Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in | |
CVE-2026-6973 |
Endpoint Manager Mobile (EPMM) | 7.2 | 0.3445 | 2026-05-07 | 2026-05-10 | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vuln | |
CVE-2021-44529 |
Endpoint Manager Cloud Service Appliance (EPM CSA) | — | — | 2024-03-25 | 2024-04-15 | RW | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code inject |
CVE-2020-15505 |
MobileIron Multiple Products | — | — | 2021-11-03 | 2022-05-03 | Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database | |
CVE-2021-22893 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | RW | Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a |
CVE-2020-8243 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin w | |
CVE-2021-22900 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability t | |
CVE-2021-22894 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulne | |
CVE-2020-8260 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Pulse Connect Secure contains an unspecified vulnerability that allows an authen | |
CVE-2021-22899 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | Ivanti Pulse Connect Secure contains a command injection vulnerability that allo | |
CVE-2019-11510 |
Pulse Connect Secure | — | — | 2021-11-03 | 2022-05-03 | RW | Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that a |
CVE-2019-11539 |
Pulse Connect Secure and Pulse Policy Secure | — | — | 2021-11-03 | 2022-05-03 | RW | Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker f |