Read the docs
TI-2022-15933 Aliases CVE-2022-35254GHSA-5g77-9q59-93h8

Use after free in Ivanti Connect Secure , Ivanti Policy Secure , and Ivanti Neurons for…

Priority MEDIUM 44CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02681 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access GatewayICS Prior to 9.1R14.3,9.1R15.2,9.1R16.2 and 22.2R4 and 22.2R1, IPS Prior to 9.1R17 and 22.3R1, Ivanti Neurons for Zero Trust Access Gateway Prior to 22.3R1—No fix listedCNA
  • Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access Gateway Vendor— Affected ICS Prior to 9.1R14.3,9.1R15.2,9.1R16.2 and 22.2R4 and 22.2R1, IPS Prior to 9.1R17 and 22.3R1, Ivanti Neurons for Zero Trust Access Gateway Prior to 22.3R1 Fixed in — No fix listed CNA

CPE configurations NVD · 76

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*before 9.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*9.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*9.1 r1.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*9.1 r10.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*9.1 r10.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*9.1 r11.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*9.1 r11.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*9.1 r11.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*9.1 r11.4VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* Versions before 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:* Versions 9.1 r1.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:* Versions 9.1 r10.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:* Versions 9.1 r10.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:* Versions 9.1 r11.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:* Versions 9.1 r11.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* Versions 9.1 r11.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* Versions 9.1 r11.4 Vulnerable ·Ivanti
Show 66 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*9.1 r11.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*9.1 r12.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:*9.1 r12.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*9.1 r16.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:*9.1 r2.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:*9.1 r3.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:*9.1 r4.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*9.1 r4.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:*9.1 r5.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:*9.1 r6.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:*9.1 r7.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:*9.1 r8.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*9.1 r8.4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:*9.1 r9.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*9.1 r9.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*9.1 r9.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*21.9 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*21.12 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*22.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*before 9.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*9.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*9.1 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:* Versions 9.1 r11.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:* Versions 9.1 r12.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:* Versions 9.1 r12.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:* Versions 9.1 r16.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:* Versions 9.1 r2.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:* Versions 9.1 r3.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:* Versions 9.1 r4.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:* Versions 9.1 r4.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:* Versions 9.1 r5.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:* Versions 9.1 r6.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:* Versions 9.1 r7.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:* Versions 9.1 r8.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:* Versions 9.1 r8.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:* Versions 9.1 r9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:* Versions 9.1 r9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:* Versions 9.1 r9.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:* Versions 21.9 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:* Versions 21.12 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:* Versions 22.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:* Versions before 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:* Versions 9.1 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35254
  2. 2026-10-03 Alias added: GHSA-5g77-9q59-93h8

References

Advisory 1

  • TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
  • TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences