Ivanti known exploited vulnerabilities
The Beam CVE database tracks 36 known exploited vulnerabilities for Ivanti: 15 critical and 21 high severity. The newest is CVE-2026-104935, published Oct 13, 2026.
These are the Ivanti vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 36
- Critical
- 15
- Known exploited (CISA KEV)
- 36
- Published in the last 30 days
- 1
All entries, newest first
CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
high8.6ExploitedOct 13, 2026CVE-2026-10520
Ivanti Sentry OS Command Injection Vulnerability
critical10.0ExploitedJun 9, 2026CVE-2026-6973
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
high7.2ExploitedMay 7, 2026CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
high7.5ExploitedFeb 10, 2026CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
critical9.8ExploitedJan 29, 2026CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
critical9.8ExploitedJan 29, 2026CVE-2025-4427
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
high7.5ExploitedMay 13, 2025CVE-2025-4428
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
high8.8ExploitedMay 13, 2025CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
critical9.8ExploitedApr 3, 2025CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
high7.5ExploitedJan 14, 2025CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
high7.5ExploitedJan 14, 2025CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
high7.5ExploitedJan 14, 2025CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
critical9.0ExploitedJan 8, 2025CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
high7.2ExploitedOct 8, 2024CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
high7.2ExploitedOct 8, 2024CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
critical9.1ExploitedSep 19, 2024CVE-2024-8190
Ivanti Cloud Services Appliance OS Command Injection Vulnerability
high7.2ExploitedSep 10, 2024CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
critical9.8ExploitedAug 13, 2024CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
high8.8ExploitedMay 31, 2024CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
high8.2ExploitedJan 31, 2024CVE-2023-46805
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
high8.2ExploitedJan 12, 2024CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
critical9.1ExploitedJan 12, 2024CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
critical9.8ExploitedAug 21, 2023CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
critical9.8ExploitedAug 15, 2023CVE-2023-35081
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
high7.2ExploitedAug 3, 2023CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
critical9.8ExploitedJul 25, 2023CVE-2021-44529
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
critical9.8ExploitedDec 8, 2021CVE-2021-22894
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
high8.8ExploitedMay 27, 2021CVE-2021-22899
Ivanti Pulse Connect Secure Command Injection Vulnerability
high8.8ExploitedMay 27, 2021CVE-2021-22900
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
high7.2ExploitedMay 27, 2021CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
critical10.0ExploitedApr 23, 2021CVE-2020-8260
Ivanti Pulse Connect Secure Code Execution Vulnerability
high7.2ExploitedOct 28, 2020CVE-2020-8243
Ivanti Pulse Connect Secure Code Execution Vulnerability
high7.2ExploitedSep 30, 2020CVE-2020-15505
Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
critical9.8ExploitedJul 7, 2020CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
critical10.0ExploitedMay 8, 2019CVE-2019-11539
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
high7.2ExploitedApr 26, 2019
