By year
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Ivanti flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by SpoofingExploited since Oct 13, 2026 · CVSS 8.6
- CVE-2026-10520 Ivanti Sentry OS Command InjectionExploited since Jun 11, 2026 · CVSS 10
- CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) Improper Input ValidationExploited since May 7, 2026 · CVSS 7.2
- CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code InjectionExploited since Apr 8, 2026 · CVSS 9.8
- CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication BypassExploited since Mar 9, 2026 · CVSS 8.6
- CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code InjectionExploited since Jan 29, 2026 · CVSS 9.8
- CVE-2025-4427 Ivanti Endpoint Manager Mobile (EPMM) Authentication BypassExploited since May 19, 2025 · CVSS 5.3
- CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM) Code InjectionExploited since May 19, 2025 · CVSS 7.2
- CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer OverflowExploited since Apr 4, 2025 · ransomware · CVSS 9
- CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path TraversalExploited since Mar 10, 2025 · CVSS 9.8
- CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path TraversalExploited since Mar 10, 2025 · CVSS 9.8
- CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path TraversalExploited since Mar 10, 2025 · CVSS 9.8
- CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer OverflowExploited since Jan 8, 2025 · ransomware · CVSS 9
- CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command InjectionExploited since Oct 9, 2024 · CVSS 7.2
- CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL InjectionExploited since Oct 9, 2024 · CVSS 6.5
- CVE-2024-29824 Ivanti Endpoint Manager (EPM) SQL InjectionExploited since Oct 2, 2024 · CVSS 8.8
- CVE-2024-7593 Ivanti Virtual Traffic Manager Authentication BypassExploited since Sep 24, 2024 · CVSS 9.8
- CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path TraversalExploited since Sep 19, 2024 · CVSS 9.4
- CVE-2024-8190 Ivanti Cloud Services Appliance OS Command InjectionExploited since Sep 13, 2024 · CVSS 7.2
- CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability Exploited since Mar 25, 2024 · ransomware · CVSS 9.8
- CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF)Exploited since Jan 31, 2024 · ransomware · CVSS 8.2
- CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication BypassExploited since Jan 18, 2024 · ransomware · CVSS 9.8
- CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication BypassExploited since Jan 10, 2024 · ransomware · CVSS 8.2
- CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command InjectionExploited since Jan 10, 2024 · ransomware · CVSS 9.1
- CVE-2023-38035 Ivanti Sentry Authentication BypassExploited since Aug 22, 2023 · ransomware · CVSS 9.8
- CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) Path TraversalExploited since Jul 31, 2023 · CVSS 7.2
- CVE-2023-35078 Ivanti Endpoint Manager Mobile Authentication BypassExploited since Jul 25, 2023 · ransomware · CVSS 9.8
- CVE-2020-15505 Ivanti MobileIron Multiple Products Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File ReadExploited since Nov 3, 2021 · ransomware · CVSS 10
- CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure Command InjectionExploited since Nov 3, 2021 · ransomware · CVSS 7.2
- CVE-2021-22900 Ivanti Pulse Connect Secure Unrestricted File UploadExploited since Nov 3, 2021 · CVSS 7.2
- CVE-2021-22899 Ivanti Pulse Connect Secure Command InjectionExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite Buffer OverflowExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-FreeExploited since Nov 3, 2021 · ransomware · CVSS 10
- CVE-2020-8260 Ivanti Pulse Connect Secure Code ExecutionExploited since Nov 3, 2021 · CVSS 7.2
- CVE-2020-8243 Ivanti Pulse Connect Secure Code ExecutionExploited since Nov 3, 2021 · CVSS 7.2
Latest high and critical flaws
- CVE-2026-111357 Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, aHigh 7 · Oct 15, 2026
- CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Critical 9.9 · Oct 13, 2026
- CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbHigh 7.7 · Oct 13, 2026
- CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modifHigh 7.5 · Oct 13, 2026
- CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-Critical 9.9 · Oct 13, 2026
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by SpoofingExploited · High 8.6 · Oct 13, 2026
- CVE-2026-83527 An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level accesHigh 8.1 · Sep 8, 2026
- CVE-2026-18851 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate theiHigh 8.8 · Sep 8, 2026
- CVE-2026-12745 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code onCritical 9.8 · Sep 8, 2026
- CVE-2026-12744 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code onCritical 9.8 · Sep 8, 2026
- CVE-2026-12651 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tHigh 8.8 · Sep 8, 2026
- CVE-2026-12650 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tCritical 9.9 · Sep 8, 2026
- CVE-2026-12648 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tHigh 8.8 · Sep 8, 2026
- CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Critical 9.9 · Sep 8, 2026
- CVE-2026-12646 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Critical 9.9 · Sep 8, 2026
- CVE-2026-12645 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Critical 9.9 · Sep 8, 2026
- CVE-2026-18129 Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITHigh 8.1 · Aug 11, 2026
- CVE-2026-18127 External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an High 7.7 · Aug 11, 2026
- CVE-2026-18125 An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.High 7.5 · Aug 11, 2026
- CVE-2026-14903 Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.High 7.7 · Jul 14, 2026
- CVE-2026-10727 An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitraryHigh 7.2 · Jun 9, 2026
- CVE-2026-10523 An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to cCritical 9.9 · Jun 9, 2026
- CVE-2026-10520 Ivanti Sentry OS Command InjectionExploited · Critical 10 · Jun 9, 2026
- CVE-2026-9614 An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative accessHigh 8.8 · Jun 1, 2026
- CVE-2026-8992 An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary codeHigh 8.8 · May 22, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.