Read the docs

Ivanti

Records525All Threatist records
Exploited (KEV)39In CISA KEV
CVSS critical123CVSS 9.0–10.0
CVSS high294CVSS 7.0–8.9

Exploited now

Ivanti records in CISA KEV
TI-2026-75040 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Priority CRITICAL 90KEV 2026-10-30TI-2026-84333 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Priority HIGH 77KEV 2026-10-30TI-2026-71839 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Priority CRITICAL 96KEV 2026-10-13TI-2026-09047 Ivanti Sentry OS Command Injection Vulnerability Priority CRITICAL 100KEV 2026-06-11TI-2026-06103 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability Priority CRITICAL 91KEV 2026-05-07TI-2026-01051 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Priority CRITICAL 100KEV 2026-04-08

Components

Products in the NVD configurations · select one to filter the records
Connect Secure 133 records CRITICAL Avalanche 117 records CRITICAL Endpoint Manager 116 records CRITICAL Policy Secure 77 records CRITICAL Endpoint Manager Mobile 29 records CRITICAL Workspace Control 22 records MEDIUM Secure Access Client 21 records MEDIUM Zero Trust Access Gateway 17 records CRITICAL

Records

22 records in Workspace Control · all components

TI-2024-29684 CVE-2024-44107 · GHSA-g5cq-mqgj-wgjv

Uncontrolled search path in Ivanti Workspace Control

Priority MEDIUM 40

DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00266 Published 2024-09-10 Fixed in 10.19.0.0 CWE-427
TI-2024-29681 CVE-2024-44104 · GHSA-99m3-849w-rg54

Authentication bypass by spoofing in Ivanti Workspace Control

Priority MEDIUM 40

An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to esc…

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00237 Published 2024-09-10 Fixed in 10.19.0.0 CWE-290
TI-2024-29680 CVE-2024-44103 · GHSA-98cg-f2r6-jq5c

Untrusted search path in Ivanti Workspace Control

Priority MEDIUM 40

DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00245 Published 2024-09-10 Fixed in 10.19.0.0 CWE-426
TI-2024-29682 CVE-2024-44105 · GHSA-qr9q-g9r2-5x7c

Cleartext transmission of sensitive information in Ivanti Workspace Control

Priority LOW 37

Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.

CVSS 3.1HIGH 8.2 Local Low privileges User interaction EPSS 0.00163 Published 2024-09-10 Fixed in 10.19.0.0 CWE-319
TI-2024-07426 CVE-2024-8012 · GHSA-mqp5-vpv8-vhqm

Authentication bypass in Ivanti Workspace Control

Priority LOW 36

An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00268 Published 2024-09-10 Fixed in 10.19.0.0 CWE-288
TI-2024-07877 CVE-2024-8496 · GHSA-2fvj-55p5-9gp4

Incorrect default permissions in Ivanti Workspace Control

Priority LOW 35

Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00209 Published 2024-12-11 Fixed in 10.18.40.0 CWE-276
TI-2022-06194 CVE-2022-21823 · GHSA-w3jg-4hwp-p898

Insecure storage of sensitive information in Ivanti Workspace Control

Priority LOW 25

A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00361 Published 2022-01-07 No fix listed CWE-922
Open these records in search →