Read the docs

Ivanti

Records525All Threatist records
Exploited (KEV)39In CISA KEV
CVSS critical123CVSS 9.0–10.0
CVSS high294CVSS 7.0–8.9

Exploited now

Ivanti records in CISA KEV
TI-2026-75040 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Priority CRITICAL 90KEV 2026-10-30TI-2026-84333 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Priority HIGH 77KEV 2026-10-30TI-2026-71839 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Priority CRITICAL 96KEV 2026-10-13TI-2026-09047 Ivanti Sentry OS Command Injection Vulnerability Priority CRITICAL 100KEV 2026-06-11TI-2026-06103 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability Priority CRITICAL 91KEV 2026-05-07TI-2026-01051 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Priority CRITICAL 100KEV 2026-04-08

Components

Products in the NVD configurations · select one to filter the records
Connect Secure 133 records CRITICAL Avalanche 117 records CRITICAL Endpoint Manager 116 records CRITICAL Policy Secure 77 records CRITICAL Endpoint Manager Mobile 29 records CRITICAL Workspace Control 22 records MEDIUM Secure Access Client 21 records MEDIUM Zero Trust Access Gateway 17 records CRITICAL

Records

17 records in Zero Trust Access Gateway · all components

TI-2025-16349 CVE-2025-22457 · GHSA-jjr5-fpcg-gc53

Stack-based buffer overflow in Ivanti Connect Secure

Priority CRITICAL 100KEV

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to ac…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99981 Published 2025-04-03 Fixed in 22.7R2.6, 22.7R1.4 +1 CWE-121
TI-2024-14645 CVE-2024-22024 · GHSA-cmg9-p9gp-g7mr

XML external entity injection in Ivanti ICS

Priority CRITICAL 86

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources wi…

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.94721 Published 2024-02-13 Fixed in 9.1R14.5, 9.1R17.3 +21 CWE-611
TI-2025-34828 CVE-2025-55145 · GHSA-qch7-73vq-h8qh

Missing authorization in Ivanti Connect Secure 22.7R2.9

Priority MEDIUM 42

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00671 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-34825 CVE-2025-55142 · GHSA-77hg-rfpf-5ghc

Missing authorization in Ivanti Connect Secure

Priority MEDIUM 42

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00964 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-34824 CVE-2025-55141 · GHSA-xjmr-hvq4-xrmr

Missing authorization in Ivanti Connect Secure

Priority MEDIUM 42

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00964 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-34830 CVE-2025-55147 · GHSA-56v7-g448-vffv

Cross-site request forgery in Ivanti Connect Secure

Priority MEDIUM 41

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00628 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-352
TI-2025-04904 CVE-2025-5462 · GHSA-ph7j-5qgh-2m7f

Heap-based buffer overflow in Ivanti Connect Secure

Priority MEDIUM 41

A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix depl…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2025-08-12 Fixed in 22.7R2.8, 22.8R2 +3 CWE-122
TI-2025-04902 CVE-2025-5456 · GHSA-68xg-w9gf-2gr9

Out-of-bounds read in Ivanti Connect Secure

Priority MEDIUM 41

A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix d…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01231 Published 2025-08-12 Fixed in 22.7R2.8, 22.8R2 +3 CWE-125
TI-2025-34831 CVE-2025-55148 · GHSA-9vj6-36jx-c7r8

Missing authorization in Ivanti Connect Secure

Priority LOW 34

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00593 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-34823 CVE-2025-55139 · GHSA-gg29-529g-r9m2

Server-side request forgery in Ivanti Connect Secure

Priority LOW 32

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00907 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-918
TI-2025-34826 CVE-2025-55143 · GHSA-gpqh-mj33-x354

Cross-site scripting in Ivanti Connect Secure

Priority LOW 29

Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00745 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-79
TI-2025-34827 CVE-2025-55144 · GHSA-7g3f-mmjm-c2x8

Missing authorization in Ivanti Connect Secure

Priority LOW 25

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00591 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-07973 CVE-2025-8712 · GHSA-4ccv-vmjr-rffr

Missing authorization in Ivanti Connect Secure before

Priority LOW 25

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00452 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-862
TI-2025-04909 CVE-2025-5468 · GHSA-3pr6-5rrr-cqpq

Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or…

Priority LOW 25

Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00403 Published 2025-08-12 Fixed in 22.7R2.8, 22.8R2 +3 CWE-61
TI-2025-34829 CVE-2025-55146 · GHSA-7xgr-fpw2-5qqh

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti…

Priority LOW 24

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00798 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-252
TI-2025-07972 CVE-2025-8711 · GHSA-c296-66xh-547q

Cross-site request forgery in Ivanti Connect Secure

Priority LOW 24

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00328 Published 2025-09-09 Fixed in 22.7R2.9, 22.8R2 +3 CWE-352
TI-2025-04907 CVE-2025-5466 · GHSA-w4wg-c34c-jf6j

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before…

Priority LOW 24

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00783 Published 2025-08-12 Fixed in 22.7R2.8, 22.8R2 +3 CWE-776
Open these records in search →