Ivanti

Known Exploited Ivanti Vulnerabilities

The following Ivanti vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 15 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 2 known exploited Ivanti vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Ivanti Vulnerabilities

Based on the current exploit probability, these Ivanti vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

By the Year

In 2026 there have been 63 vulnerabilities in Ivanti with an average score of 7.7 out of ten. Last year, in 2025 Ivanti had 89 security vulnerabilities published. Right now, Ivanti is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.69.

Recent Ivanti Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-83528	Nov 10, 2026	Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.	Endpoint Manager Mobile
CVE-2026-107405	Nov 10, 2026	An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.	Endpoint Manager Mobile
CVE-2026-107404	Nov 10, 2026	Ivanti EPMM Argument Injection (pre-12.10.0.1/12.9.0.3/12.8.0.5) File Deletion Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.	Endpoint Manager Mobile
CVE-2026-105427	Nov 10, 2026	Ivanti EPMM <12.10.0.1,12.9.0.3,12.8.0.5 Improper Input Validation DoS Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.	Endpoint Manager Mobile
CVE-2026-105426	Nov 10, 2026	Ivanti EPMM Authenticated Admin Arbitrary Linux Kernel Param RCE Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.	Endpoint Manager Mobile
CVE-2026-123181	Nov 10, 2026	Ivanti Sentry <10.7.4/10.8.3 Path Traversal Arbitrary File Creation A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.
CVE-2026-123179	Nov 10, 2026	Ivanti Sentry <10.7.4 & <10.8.3 Tomcat shutdown listener DoS An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service.
CVE-2026-105669	Nov 10, 2026	Ivanti Sentry <10.8.3 & <10.7.4 Arg Inj Remote Code Exec Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.
CVE-2026-105425	Nov 10, 2026	Ivanti Sentry/EPMM OS Command Injection before 10.7.4, 10.8.3, 11.0.0 OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.	Endpoint Manager Mobile
CVE-2026-121683	Nov 10, 2026	Ivanti Cloud Services App 5.0.8 Auth Bypass Remote Cert Add/Delete Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
CVE-2026-18128	Nov 10, 2026	Ivanti Endpoint Manager Agent Cleartext Transmission (MITM) Vulnerability Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.	Endpoint Manager
CVE-2026-121653	Nov 10, 2026	Ivanti Endpoint Manager SQLi leading to RCE (pre2024 SU8) SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.	Endpoint Manager
CVE-2026-105813	Nov 10, 2026	Ivanti UWM <2026.4 Cleartext Session Token Storage Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.
CVE-2026-118527	Nov 03, 2026	Ivanti Connect Secure predictable filenames (pre 25.1.1.3 & 22.8R2.6) Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.	Connect Secure
CVE-2026-111357	Oct 15, 2026	Ivanti Connect Secure 22.8R2.4 PrivEsc via DSCache dsinvoked broker Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.	Connect Secure
CVE-2026-109412	Oct 13, 2026	Ivanti Neurons Patch for Intune Auth Info Leak via Exposed Endpoint An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
CVE-2026-106047	Oct 13, 2026	Ivanti Xtraction <2026.4 Path Traversal in Template Export (Auth) A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
CVE-2026-106043	Oct 13, 2026	Ivanti Xtraction <2026.4 Auth Bypass for Critical Function A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
CVE-2026-106042	Oct 13, 2026	Ivanti Xtraction <2026.4 Remote Auth ECFP to steal EPMM creds An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
CVE-2026-106035	Oct 13, 2026	Ivanti Xtraction Cloud Sync <2026.4 Log File Info Disclosure An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.
CVE-2026-106034	Oct 13, 2026	Ivanti Xtraction <2026.4 Path Traversal (CVE-2026-106034) A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
CVE-2026-104935	Oct 13, 2026	Ivanti ICS <25.1.3.0 Auth Bypass & RCE via Spoofing Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.	Connect Secure
CVE-2026-12647	Sep 08, 2026	Missing Auth in Ivanti Neurons for ITSM <2026.2 Allows Remote Code Exec A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12646	Sep 08, 2026	Missing Auth in Ivanti Neurons for ITSM before 2026.2 Remote Code Exec A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12645	Sep 08, 2026	Missing Auth in Ivanti Neurons for ITSM v<2026.2 (Remote Code Exec) A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-83527	Sep 08, 2026	Authentication Bypass in Sentry <= R10.8.2/ R10.7.3/ R10.6.4 (admin access) An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
CVE-2026-12648	Sep 08, 2026	Remote Code Exec via Deserialization in Ivanti Neurons for ITSM <2026.2 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12650	Sep 08, 2026	Ivanti Neurons for ITSM < 2026.2: Deserialization RCE via Untrusted Data A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12651	Sep 08, 2026	Deserialization Vulnerability in Ivanti Neurons for ITSM <2026.2 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12745	Sep 08, 2026	Deserialization of Untrusted Data in Ivanti Neurons for ITSM <2026.2 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-12744	Sep 08, 2026	Ivanti Neurons for ITSM <2026.2 Deserialization RCE A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.	Neurons For Itsm
CVE-2026-18851	Sep 08, 2026	Ivanti Endpoint Manager Mobile Priv Escalation (Missing Auth) before 12.10.0.0 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.	Endpoint Manager Mobile
CVE-2026-18129	Aug 11, 2026	Cleartext credentials leakage in Ivanti Endpoint Manager Core Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.	Endpoint Manager
CVE-2026-18127	Aug 11, 2026	CVE-2026-18127: File-name Injection in Ivanti Endpoint Mgr Core Gaining S3 Write External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.	Endpoint Manager
CVE-2026-18125	Aug 11, 2026	OOB Read in Ivanti Endpoint Manager Agent An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.	Endpoint Manager
CVE-2026-14903	Jul 14, 2026	Path Traversal in Ivanti Xtraction (pre-2026.2.1) allows remote file read Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
CVE-2026-14902	Jul 14, 2026	Open Redirect in Ivanti Xtraction <2026.2.1: Arbitrary URLs An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
CVE-2024-58352	Jul 02, 2026	Landray OA Unauth HQL Injection via wechatLoginHelper.do Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).	Automation
CVE-2026-10727	Jun 09, 2026	Os command injection in Ivanti EPMM <12.9.0.1, 12.8.0.3, 12.7.0.2 Allows root exec An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root	Endpoint Manager Mobile
CVE-2026-10523	Jun 09, 2026	Auth Bypass in Ivanti Sentry <10.5.2/10.6.2/10.7.1 Enables Remote Admin Creation An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
CVE-2026-10520	Jun 09, 2026	OS Command Injection RCE in Ivanti Sentry < R10.5.2,R10.6.2,R10.7.1 An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2026-9614	Jun 01, 2026	Improper Access Control: Ivanti Neurons for ITSM An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.	Neurons For Itsm
CVE-2026-8992	May 22, 2026	Ivanti Secure Access Client pre-22.8R6 certificate validation flaw (CVE-2026-8992) An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.	Secure Access Client
CVE-2026-8111	May 12, 2026	SQLi in Ivanti Endpoint Manager web console enables RCE SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.	Endpoint Manager
CVE-2026-8110	May 12, 2026	Perms issue in Ivanti Endpoint Manager agent allows local privilege escalation Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.	Endpoint Manager
CVE-2026-8109	May 12, 2026	Exposed method in Ivanti Endpoint Mgmt Core Server leaks credentials An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.	Endpoint Manager
CVE-2026-8051	May 12, 2026	CVE-2026-8051: OS Cmd Injection in Ivanti Virtual Traffic Manager <22.9r4 OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2026-7432	May 12, 2026	Race Condition in Ivanti Secure Access Client (<22.8R6) Privilege Escalation A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM	Secure Access Client
CVE-2026-7431	May 12, 2026	Ivanti Secure Access Client <22.8R6 -- LGC via Shared Memory An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.	Secure Access Client
CVE-2026-8043	May 12, 2026	External File Name Control in Ivanti Xtraction <2026.2: Authenticated R/W External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.