Ivanti
Monthly
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
An insufficiently protected endpoint in Ivanti Neurons Patch for Intune exposes sensitive authentication information to a remote attacker who already holds a valid low-privilege account on the application, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, which limits the confirmed impact to confidentiality. Exploitation is low complexity and requires no user interaction, but it is gated by the need for an authenticated session and by network reachability to the management interface, so organizations that keep the console on a trusted admin network materially reduce exposure. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the leaked credential material becomes dangerous mainly if it can be reused against the platform or federated services.
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0 and execute arbitrary commands with full system compromise. This vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists. Ivanti Connect Secure 22.7R2.14 and prior are explicitly not affected, and the vendor-released patch is version 25.1.3.0 or later.
Authenticated remote code execution in Ivanti Neurons for ITSM (all versions before the 2026.2 patch) lets any holder of a valid low-privilege account invoke a server-side function that performs no authorization check, yielding total loss of confidentiality, integrity, and availability on the ITSM server. Exploitation requires credentials and network reachability to the application (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), so this is not a pre-authentication flaw; CISA's SSVC assessment rates exploitation as none and automatability as no, meaning targeted rather than mass abuse, and no public exploit code or confirmed active exploitation (KEV) has been identified at time of analysis. EPSS is 1.19% (66th percentile), a moderate score consistent with a high-impact but credential-gated issue that is not currently an emergency, though the impact per successful exploitation is severe.
Missing authorization in Ivanti Neurons for ITSM allows an authenticated attacker holding any valid account on the instance to reach server-side functionality they should not access, ultimately achieving arbitrary code execution on the host (CWE-862, CVSS 8.8). Only deployments running versions prior to 2026.2 are affected, and the flaw cannot be triggered without first obtaining valid credentials, since the CVSS vector is PR:L (low-privileged, authenticated) with no user interaction required. Exploitation is rated as not automatable by SSVC, EPSS remains low at 1.19% (66th percentile), and no public exploit was identified at time of analysis, so this is a high-priority patching item rather than an emergency.
Remote code execution in Ivanti Neurons for ITSM before 2026.2 allows an authenticated attacker holding only a low-privilege account to invoke server-side functionality that lacks a proper authorization check and use it to run arbitrary code on the underlying server. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the attacker needs a valid credential but nothing more - no user interaction, no administrative role, and the vulnerable path is reachable over the network. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, with the exploit rated non-automatable because it cannot be triggered pre-authentication against default configurations; EPSS is modest at roughly 1.2% (67th percentile), but CISA SSVC grades the technical impact as total, so the combination of an easy-to-reach authenticated path and full confidentiality, integrity and availability loss makes this a high-priority item for any organization running the affected versions.
Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. No public exploit or CISA KEV listing is associated at time of analysis, though the vendor self-disclosed via a security advisory, and the all-high C:H/I:H/A:H impact from administrative compromise makes this a critical patching priority for enterprises running Sentry in mobile security gateway roles.
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. No public exploit code or CISA KEV listing is identified at time of analysis, but Ivanti EPMM has a well-documented history of targeted exploitation in prior CVE cycles.
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Full write control over configured S3 session recording buckets is achievable in Ivanti Endpoint Manager (EPM) before version 2024 SU7 by remote authenticated attackers exploiting a CWE-73 filename control flaw. The Core component fails to sanitize user-supplied input used to construct S3 object paths, enabling any low-privilege authenticated EPM user to write arbitrary data to the session recording bucket - potentially overwriting or corrupting forensic evidence. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available as EPM 2024 SU7.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Command injection in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 enables an authenticated administrator with high privileges to execute arbitrary OS commands as root on the underlying server. No public exploit identified at time of analysis, and the issue is not currently listed on the CISA KEV catalog, but Ivanti EPMM has a history of being a high-value target for nation-state actors which elevates real-world urgency. The high-privilege precondition limits opportunistic abuse but the root-level outcome makes this a credible privilege-escalation and lateral-movement vector.
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative control of the appliance. Publicly available exploit code exists (watchTowr Labs PoC chained with CVE-2026-10520 for RCE), though it is not yet listed in CISA KEV; EPSS sits at a modest 0.31% (54th percentile) despite the critical CVSS 9.8 rating.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to achieve root-level command execution via OS command injection. With a maximum CVSS score of 10.0 and a network-accessible, no-interaction attack vector, this represents a critical exposure for any internet-facing Sentry appliance, though no public exploit has been identified at time of analysis.
Privilege escalation to administrative access in Ivanti Neurons for ITSM (both cloud and on-premises deployments) allows a remote authenticated attacker to bypass access controls and obtain admin-level permissions. The flaw carries a CVSS 8.8 rating with low attack complexity, and Ivanti has published a security advisory; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Remote code execution in Ivanti Secure Access Client versions prior to 22.8R6 allows unauthenticated attackers to run arbitrary code on endpoints by exploiting improper TLS certificate validation, contingent on user interaction (UI:R). No public exploit identified at time of analysis, but the CVSS 8.8 rating and Ivanti's own advisory disclosure mark this as a high-priority client-side risk for organizations using the VPN client.
SQL injection in Ivanti Endpoint Manager web console enables authenticated remote attackers to execute arbitrary code on the server. Affects all versions prior to 2024 SU6. Attack requires only low-privilege authenticated access (CVSS PR:L) with low complexity (AC:L), making exploitation straightforward for any authenticated user. Ivanti has released patched version 2024 SU6 per vendor advisory dated May 2026. No CISA KEV listing or public exploit code identified at time of analysis, indicating exploitation not yet confirmed in the wild despite high severity score.
Local privilege escalation in Ivanti Endpoint Manager agent allows authenticated users to gain SYSTEM-level privileges via incorrect file or registry permissions. Affects all versions prior to 2024 SU6. Vendor has released a patch (version 2024 SU6). No evidence of active exploitation or public POC identified at time of analysis, though EPSS data not available. Organizations running EPM agents on managed endpoints should prioritize patching given the high CVSS score (7.8) and potential for lateral movement across enterprise environments.
Remote code execution in Ivanti Virtual Traffic Manager allows authenticated administrators to execute arbitrary OS commands via command injection. Affects all versions before 22.9r4. Attack requires network access and administrative credentials but has low complexity (CVSS AC:L). No active exploitation confirmed at time of analysis, though administrative access requirement significantly limits attack surface compared to unauthenticated RCE vulnerabilities.
Race condition in Ivanti Secure Access Client enables local privilege escalation to SYSTEM from low-privileged accounts. Affects versions before 22.8R6. An authenticated local user can exploit timing vulnerabilities in the client software to gain complete system control. While limited to local attack vector (requires existing access to the target system), the low attack complexity (AC:L) and lack of user interaction requirement (UI:N) make this exploitable once local access is achieved. No public exploit code identified at time of analysis, and EPSS risk scoring not yet available for this 2026 CVE.
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.
Improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) enables remote unauthenticated attackers to enroll restricted devices without authorization, exposing appliance configuration details and compromising enrolled device identity integrity. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. CVSS 7.4 with high attack complexity suggests exploitation requires specific timing or conditions. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though Ivanti products have been frequent targets of nation-state actors in recent years.
Remote code execution in Ivanti Endpoint Manager Mobile (EPMM) allows authenticated administrators to execute arbitrary code on the server. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 through improper input validation vulnerabilities. While requiring high-privilege administrator credentials (CVSS PR:H), the vulnerability enables complete system compromise once authenticated, with high impact to confidentiality, integrity, and availability. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated attackers can invoke arbitrary methods in Ivanti Endpoint Manager Mobile (EPMM) via improper access control flaws, enabling authentication bypass and potential system compromise. Affects versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS vector indicates network-accessible exploitation with high attack complexity, resulting in high integrity impact and limited confidentiality/availability impact. No active exploitation confirmed via CISA KEV at time of analysis, though the authentication bypass tag and Ivanti's history of targeted attacks warrant elevated monitoring.
Certificate validation bypass in Ivanti Endpoint Manager Mobile (EPMM) allows remote unauthenticated attackers to impersonate registered Sentry hosts and fraudulently obtain CA-signed client certificates. Affects all versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. High-severity network attack (CVSS 8.9) with changed scope indicating potential pivot to additional systems. No active exploitation confirmed in CISA KEV at time of analysis, but Ivanti products are frequent targets requiring immediate patching priority.
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) allows remote authenticated attackers with low-level credentials to gain full administrative access. Affected versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 contain an improper access control flaw (CWE-284) that enables credential-holding users to bypass authorization checks and assume administrative privileges. With CVSS 8.8 (High) and network-exploitable attack vector requiring only low privileges, this represents a significant risk for enterprise mobile device management environments, though EPSS data and active exploitation status are not available at time of analysis.
Privilege escalation in Ivanti DSM versions before 2026.1.1 stems from an exposed dangerous method that allows authenticated local users to gain elevated system privileges. An attacker with local access could exploit this vulnerability to obtain high-level permissions, compromising system integrity and confidentiality. No patch is currently available for this issue.
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that allows unauthenticated attackers to achieve remote code execution on the mobile device management server. Compromising the MDM server provides access to all managed mobile device configurations, policies, and potentially the ability to push malicious profiles to enrolled devices.
Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code. With EPSS 64.8% and KEV listing, this vulnerability in the mobile device management platform threatens the security of every managed mobile device in the organization, as EPMM has the ability to push configurations, certificates, and apps to enrolled devices.
Ivanti Endpoint Manager Mobile (EPMM) contains an authenticated code injection in the API component, allowing authenticated attackers to execute arbitrary code through crafted API requests.
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA Gateways (before 22.8R2.2) lets a remote unauthenticated attacker overflow a stack buffer to run arbitrary code on the appliance. This flaw is confirmed actively exploited (CISA KEV), with publicly available exploit code and reporting of a suspected China-nexus threat actor, and it carries an elevated EPSS of 53.66% (98th percentile), placing it among the highest-risk internet-facing edge-device vulnerabilities.
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosure, completing the triple path traversal set in the January 2025 security update.
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosure, part of the triple path traversal affecting EPM's January 2025 security update.
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to leak sensitive information from the EPM server, one of three related Ivanti EPM path traversal CVEs.
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated remote code execution, the second major Ivanti VPN zero-day in twelve months.
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in Ivanti Virtual Traffic Manager (vTM) admin panel allows remote unauthenticated attackers to gain administrative access to the appliance due to a flawed authentication algorithm implementation. The flaw is confirmed actively exploited (CISA KEV) with an EPSS score of 94.44% (100th percentile), placing it among the highest-risk vulnerabilities currently tracked. All vTM releases other than 22.2R1 and 22.7R2 are affected.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis.
Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administrators to execute arbitrary commands, chained with CVE-2023-46805 for unauthenticated RCE.
Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated access to restricted resources, chained with CVE-2024-21887 for unauthenticated RCE in massive exploitation campaigns starting January 2024.
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged user with local access to the application log. The authoritative assessment rates this CWE-532 information disclosure as AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access, low privileges, and limited confidentiality impact because only partial passwords are logged rather than full credentials; no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent threat, and it is fixed in version 2026.4.
Path traversal in Ivanti Xtraction (all versions before 2026.4) lets a remote authenticated attacker create or modify directories at arbitrary locations on the host file system by supplying crafted path input to a directory-handling feature. The vendor rates it 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N), reflecting a scope change onto the underlying host with integrity-only impact and no confirmed confidentiality or availability effect; exploitation requires a valid Xtraction account, and no public exploit code has been identified at time of analysis. Upgrading to 2026.4 removes the vulnerable condition.
Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations.
Remote authenticated attackers can exploit an exposed dangerous method on the Core Server of Ivanti Endpoint Manager versions before 2024 SU6 to leak access credentials. The vulnerability requires valid authentication credentials to exploit and does not allow code execution or system modification, but compromises confidentiality by exposing sensitive authentication material that could facilitate lateral movement or account takeover.
Ivanti Secure Access Client before version 22.8R6 allows local authenticated users to read or modify sensitive log data through write access to a shared memory section due to incorrect permission assignments on a critical resource. With a CVSS score of 4.4 and a local attack vector requiring authentication, this vulnerability poses a moderate risk to users whose systems are accessed by multiple authenticated accounts. No active exploitation has been publicly confirmed, but the simplicity of the attack (local, low complexity) makes this a practical concern for multi-user systems.
Stored cross-site scripting (XSS) in Ivanti Neurons for ITSM (on-premise and cloud) before version 2025.4 allows authenticated remote attackers to inject malicious scripts that execute in other users' sessions, enabling limited information disclosure. User interaction is required to trigger the vulnerability. No public exploit code or active exploitation has been identified.
Ivanti Neurons for ITSM before version 2025.4 allows authenticated attackers to retain access to disabled accounts via an unprotected alternate authentication path, enabling persistent unauthorized information disclosure. The vulnerability affects both on-premise and cloud deployments and requires user interaction (UI:R), limiting but not eliminating real-world risk in multi-user environments where account disablement is a critical security control.
Authenticated attackers can exploit SQL injection in Ivanti Endpoint Manager prior to version 2024 SU5 to extract sensitive data from the underlying database. This network-accessible vulnerability requires valid credentials but allows unauthorized information disclosure with no user interaction needed. No patch is currently available for affected systems.
Ivanti Endpoint Manager fails to properly verify cryptographic signatures on patch and update packages processed by its patch management component (CWE-347), allowing a crafted package bearing a forged or invalid signature to be accepted and executed. Per the vendor CVSS vector (AV:L/AC:L/PR:N/UI:R), the attack requires delivery of a malicious update package to the affected component and a mandatory user-interaction step before arbitrary code executes, so it is not a hands-off remote exploit despite the description's 'remote' wording; only Endpoint Manager builds at or below 2024 SU4 (including 2024, SU1, SU2, SU3, SU3 SR1 and SU4) are affected. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV; a vendor fix is available in 2024 SU4 SR1 and later.
Path traversal in Ivanti Endpoint Manager 2024 through 2024 SU4 (including SU1, SU2, SU3, and SU3 Security Release 1) lets a remote attacker who already holds valid authenticated access, and who can also induce a legitimate user to perform an action, write arbitrary files outside the intended target directory on the EPM server. The two prerequisites - authenticated access (CVSS PR:L) plus required user interaction (CVSS UI:R) - substantially limit the exposure compared with an unauthenticated, fully automated attack, though the impact of a successful write is high (CVSS Integrity/High, Availability/High; vendor score 8.0, independent assessment 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in Ivanti Endpoint Manager 2024 SU4 SR1. This is a credible, above-average priority issue but not a drop-everything emergency based on current signals.
Arbitrary file write on the Ivanti Endpoint Manager server, exploitable by a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) when the victim performs an attacker-influenced action, with the potential to escalate to remote code execution on the EPM host. All EPM 2024 releases prior to 2024 SU4 SR1 are affected, including the 2024 base release through SU1, SU2, SU3, SU3 Security Release 1, and SU4. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), though the unauthenticated network vector combined with high confidentiality and integrity impact makes it a credible high-priority patch item; the mandatory user interaction (UI:R) is the principal limiting factor.
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3 Security Release 1) lets a remote unauthenticated attacker plant a persistent JavaScript payload that executes in the browser context of an administrator's EPM console session once that administrator views the poisoned page. Because the script runs inside an authenticated admin session, it can read or modify administrative data and perform actions as the victim, though the scope-limited CVSS impact (C:L/I:L/A:N) and the mandatory administrator interaction (UI:R) constrain the damage. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, but the EPSS score is elevated at 33.50% (98th percentile), indicating strong model-based likelihood of exploitation attempts; the vendor fix is Ivanti Endpoint Manager 2024 SU4 SR1.
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Path traversal in the administrative console of Ivanti Endpoint Manager Mobile (EPMM) allows an authenticated attacker holding administrator privileges to write files to unintended locations on the underlying disk, corrupting or overwriting data with high integrity impact and a limited availability effect. Only deployments running EPMM versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4 are affected, and exploitation requires a pre-existing admin session (CVSS PR:H), which sharply constrains real-world exposure - the practical risk is confined to environments where admin credentials are already compromised or where this is chained with a separate authentication-bypass flaw. At time of analysis there is no public exploit identified, EPSS is low at 0.62% (48th percentile), and the flaw is not listed in CISA KEV, making it a lower-tier priority despite the security-sensitive nature of the appliance.
Authenticated attackers holding administrator privileges on Ivanti EPMM can inject OS commands through the admin panel and execute arbitrary code on the underlying server in versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4. The flaw carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS probability of 20.35% (97th percentile), indicating elevated likelihood of exploitation activity, although no public exploit code or CISA KEV listing was identified at time of analysis. Because the prerequisite is an already-compromised administrative session, practical risk escalates where admin interfaces are reachable from untrusted networks or where credentials are reused.
Authenticated OS command injection in Ivanti Endpoint Manager Mobile (EPMM) allows a remote attacker with admin privileges to execute arbitrary OS commands and achieve remote code execution on versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4. Exploitation requires a valid admin session (CVSS PR:H), and no public exploit has been identified at time of analysis; however, the EPSS score is 20.35% (97th percentile), indicating elevated risk. The impact is high, with potential for full compromise of the EPMM server.
OS command injection in the administrative panel of Ivanti Endpoint Manager Mobile (EPMM) enables remote code execution for an attacker who already possesses an authenticated admin session. The flaw affects versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4; the CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N) because the high privilege prerequisite limits the attack surface. Despite the moderate base score, the EPSS score of 20.35% (97th percentile) indicates an unusually high exploitation probability, though no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote attacker who holds valid low-privilege credentials (PR:L, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read arbitrary data from the product's backend database; no user interaction or administrative rights are required, but network reachability to the EPM interface and an authenticated session are prerequisites, so realistic exposure is limited to insiders, compromised accounts, or consoles reachable by lower-trust users. The vendor rates the issue 6.5 (moderate) with high confidentiality impact only, and no public exploit code has been identified at time of analysis; EPSS is 0.82% (56th percentile), indicating low near-term exploitation likelihood, and the vulnerability is not confirmed actively exploited (not listed in CISA KEV).
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache configuration data and can be induced to act on attacker-controlled input. Exploitation is not remote in isolation: the CVSS vector (AV:L/PR:L/AC:H) requires an attacker to already hold a low-privileged foothold on the appliance plus the specific broker/DSCache state needed to satisfy the high attack-complexity constraint. The practical risk is elevated because the CVE description and Volexity reporting tie this flaw to chained exploitation of upstream unauthenticated issues in October 2026, which removes the local-access barrier for a real attacker; no CISA KEV entry is present in the supplied data, and no specific patch version is provided. Treat this as a genuine high-priority hardening item - the exploitation signals are reported but the remediation data is incomplete.
An insufficiently protected endpoint in Ivanti Neurons Patch for Intune exposes sensitive authentication information to a remote attacker who already holds a valid low-privilege account on the application, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, which limits the confirmed impact to confidentiality. Exploitation is low complexity and requires no user interaction, but it is gated by the need for an authenticated session and by network reachability to the management interface, so organizations that keep the console on a trusted admin network materially reduce exposure. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the leaked credential material becomes dangerous mainly if it can be reused against the platform or federated services.
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0 and execute arbitrary commands with full system compromise. This vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists. Ivanti Connect Secure 22.7R2.14 and prior are explicitly not affected, and the vendor-released patch is version 25.1.3.0 or later.
Authenticated remote code execution in Ivanti Neurons for ITSM (all versions before the 2026.2 patch) lets any holder of a valid low-privilege account invoke a server-side function that performs no authorization check, yielding total loss of confidentiality, integrity, and availability on the ITSM server. Exploitation requires credentials and network reachability to the application (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), so this is not a pre-authentication flaw; CISA's SSVC assessment rates exploitation as none and automatability as no, meaning targeted rather than mass abuse, and no public exploit code or confirmed active exploitation (KEV) has been identified at time of analysis. EPSS is 1.19% (66th percentile), a moderate score consistent with a high-impact but credential-gated issue that is not currently an emergency, though the impact per successful exploitation is severe.
Missing authorization in Ivanti Neurons for ITSM allows an authenticated attacker holding any valid account on the instance to reach server-side functionality they should not access, ultimately achieving arbitrary code execution on the host (CWE-862, CVSS 8.8). Only deployments running versions prior to 2026.2 are affected, and the flaw cannot be triggered without first obtaining valid credentials, since the CVSS vector is PR:L (low-privileged, authenticated) with no user interaction required. Exploitation is rated as not automatable by SSVC, EPSS remains low at 1.19% (66th percentile), and no public exploit was identified at time of analysis, so this is a high-priority patching item rather than an emergency.
Remote code execution in Ivanti Neurons for ITSM before 2026.2 allows an authenticated attacker holding only a low-privilege account to invoke server-side functionality that lacks a proper authorization check and use it to run arbitrary code on the underlying server. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the attacker needs a valid credential but nothing more - no user interaction, no administrative role, and the vulnerable path is reachable over the network. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, with the exploit rated non-automatable because it cannot be triggered pre-authentication against default configurations; EPSS is modest at roughly 1.2% (67th percentile), but CISA SSVC grades the technical impact as total, so the combination of an easy-to-reach authenticated path and full confidentiality, integrity and availability loss makes this a high-priority item for any organization running the affected versions.
Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. No public exploit or CISA KEV listing is associated at time of analysis, though the vendor self-disclosed via a security advisory, and the all-high C:H/I:H/A:H impact from administrative compromise makes this a critical patching priority for enterprises running Sentry in mobile security gateway roles.
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. No public exploit code or CISA KEV listing is identified at time of analysis, but Ivanti EPMM has a well-documented history of targeted exploitation in prior CVE cycles.
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments.
Full write control over configured S3 session recording buckets is achievable in Ivanti Endpoint Manager (EPM) before version 2024 SU7 by remote authenticated attackers exploiting a CWE-73 filename control flaw. The Core component fails to sanitize user-supplied input used to construct S3 object paths, enabling any low-privilege authenticated EPM user to write arbitrary data to the session recording bucket - potentially overwriting or corrupting forensic evidence. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available as EPM 2024 SU7.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Command injection in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 enables an authenticated administrator with high privileges to execute arbitrary OS commands as root on the underlying server. No public exploit identified at time of analysis, and the issue is not currently listed on the CISA KEV catalog, but Ivanti EPMM has a history of being a high-value target for nation-state actors which elevates real-world urgency. The high-privilege precondition limits opportunistic abuse but the root-level outcome makes this a credible privilege-escalation and lateral-movement vector.
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative control of the appliance. Publicly available exploit code exists (watchTowr Labs PoC chained with CVE-2026-10520 for RCE), though it is not yet listed in CISA KEV; EPSS sits at a modest 0.31% (54th percentile) despite the critical CVSS 9.8 rating.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to achieve root-level command execution via OS command injection. With a maximum CVSS score of 10.0 and a network-accessible, no-interaction attack vector, this represents a critical exposure for any internet-facing Sentry appliance, though no public exploit has been identified at time of analysis.
Privilege escalation to administrative access in Ivanti Neurons for ITSM (both cloud and on-premises deployments) allows a remote authenticated attacker to bypass access controls and obtain admin-level permissions. The flaw carries a CVSS 8.8 rating with low attack complexity, and Ivanti has published a security advisory; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Remote code execution in Ivanti Secure Access Client versions prior to 22.8R6 allows unauthenticated attackers to run arbitrary code on endpoints by exploiting improper TLS certificate validation, contingent on user interaction (UI:R). No public exploit identified at time of analysis, but the CVSS 8.8 rating and Ivanti's own advisory disclosure mark this as a high-priority client-side risk for organizations using the VPN client.
SQL injection in Ivanti Endpoint Manager web console enables authenticated remote attackers to execute arbitrary code on the server. Affects all versions prior to 2024 SU6. Attack requires only low-privilege authenticated access (CVSS PR:L) with low complexity (AC:L), making exploitation straightforward for any authenticated user. Ivanti has released patched version 2024 SU6 per vendor advisory dated May 2026. No CISA KEV listing or public exploit code identified at time of analysis, indicating exploitation not yet confirmed in the wild despite high severity score.
Local privilege escalation in Ivanti Endpoint Manager agent allows authenticated users to gain SYSTEM-level privileges via incorrect file or registry permissions. Affects all versions prior to 2024 SU6. Vendor has released a patch (version 2024 SU6). No evidence of active exploitation or public POC identified at time of analysis, though EPSS data not available. Organizations running EPM agents on managed endpoints should prioritize patching given the high CVSS score (7.8) and potential for lateral movement across enterprise environments.
Remote code execution in Ivanti Virtual Traffic Manager allows authenticated administrators to execute arbitrary OS commands via command injection. Affects all versions before 22.9r4. Attack requires network access and administrative credentials but has low complexity (CVSS AC:L). No active exploitation confirmed at time of analysis, though administrative access requirement significantly limits attack surface compared to unauthenticated RCE vulnerabilities.
Race condition in Ivanti Secure Access Client enables local privilege escalation to SYSTEM from low-privileged accounts. Affects versions before 22.8R6. An authenticated local user can exploit timing vulnerabilities in the client software to gain complete system control. While limited to local attack vector (requires existing access to the target system), the low attack complexity (AC:L) and lack of user interaction requirement (UI:N) make this exploitable once local access is achieved. No public exploit code identified at time of analysis, and EPSS risk scoring not yet available for this 2026 CVE.
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.
Improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) enables remote unauthenticated attackers to enroll restricted devices without authorization, exposing appliance configuration details and compromising enrolled device identity integrity. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. CVSS 7.4 with high attack complexity suggests exploitation requires specific timing or conditions. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though Ivanti products have been frequent targets of nation-state actors in recent years.
Remote code execution in Ivanti Endpoint Manager Mobile (EPMM) allows authenticated administrators to execute arbitrary code on the server. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 through improper input validation vulnerabilities. While requiring high-privilege administrator credentials (CVSS PR:H), the vulnerability enables complete system compromise once authenticated, with high impact to confidentiality, integrity, and availability. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated attackers can invoke arbitrary methods in Ivanti Endpoint Manager Mobile (EPMM) via improper access control flaws, enabling authentication bypass and potential system compromise. Affects versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS vector indicates network-accessible exploitation with high attack complexity, resulting in high integrity impact and limited confidentiality/availability impact. No active exploitation confirmed via CISA KEV at time of analysis, though the authentication bypass tag and Ivanti's history of targeted attacks warrant elevated monitoring.
Certificate validation bypass in Ivanti Endpoint Manager Mobile (EPMM) allows remote unauthenticated attackers to impersonate registered Sentry hosts and fraudulently obtain CA-signed client certificates. Affects all versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. High-severity network attack (CVSS 8.9) with changed scope indicating potential pivot to additional systems. No active exploitation confirmed in CISA KEV at time of analysis, but Ivanti products are frequent targets requiring immediate patching priority.
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) allows remote authenticated attackers with low-level credentials to gain full administrative access. Affected versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 contain an improper access control flaw (CWE-284) that enables credential-holding users to bypass authorization checks and assume administrative privileges. With CVSS 8.8 (High) and network-exploitable attack vector requiring only low privileges, this represents a significant risk for enterprise mobile device management environments, though EPSS data and active exploitation status are not available at time of analysis.
Privilege escalation in Ivanti DSM versions before 2026.1.1 stems from an exposed dangerous method that allows authenticated local users to gain elevated system privileges. An attacker with local access could exploit this vulnerability to obtain high-level permissions, compromising system integrity and confidentiality. No patch is currently available for this issue.
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that allows unauthenticated attackers to achieve remote code execution on the mobile device management server. Compromising the MDM server provides access to all managed mobile device configurations, policies, and potentially the ability to push malicious profiles to enrolled devices.
Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code. With EPSS 64.8% and KEV listing, this vulnerability in the mobile device management platform threatens the security of every managed mobile device in the organization, as EPMM has the ability to push configurations, certificates, and apps to enrolled devices.
Ivanti Endpoint Manager Mobile (EPMM) contains an authenticated code injection in the API component, allowing authenticated attackers to execute arbitrary code through crafted API requests.
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA Gateways (before 22.8R2.2) lets a remote unauthenticated attacker overflow a stack buffer to run arbitrary code on the appliance. This flaw is confirmed actively exploited (CISA KEV), with publicly available exploit code and reporting of a suspected China-nexus threat actor, and it carries an elevated EPSS of 53.66% (98th percentile), placing it among the highest-risk internet-facing edge-device vulnerabilities.
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosure, completing the triple path traversal set in the January 2025 security update.
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosure, part of the triple path traversal affecting EPM's January 2025 security update.
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to leak sensitive information from the EPM server, one of three related Ivanti EPM path traversal CVEs.
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated remote code execution, the second major Ivanti VPN zero-day in twelve months.
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in Ivanti Virtual Traffic Manager (vTM) admin panel allows remote unauthenticated attackers to gain administrative access to the appliance due to a flawed authentication algorithm implementation. The flaw is confirmed actively exploited (CISA KEV) with an EPSS score of 94.44% (100th percentile), placing it among the highest-risk vulnerabilities currently tracked. All vTM releases other than 22.2R1 and 22.7R2 are affected.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis.
Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administrators to execute arbitrary commands, chained with CVE-2023-46805 for unauthenticated RCE.
Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated access to restricted resources, chained with CVE-2024-21887 for unauthenticated RCE in massive exploitation campaigns starting January 2024.
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged user with local access to the application log. The authoritative assessment rates this CWE-532 information disclosure as AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access, low privileges, and limited confidentiality impact because only partial passwords are logged rather than full credentials; no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent threat, and it is fixed in version 2026.4.
Path traversal in Ivanti Xtraction (all versions before 2026.4) lets a remote authenticated attacker create or modify directories at arbitrary locations on the host file system by supplying crafted path input to a directory-handling feature. The vendor rates it 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N), reflecting a scope change onto the underlying host with integrity-only impact and no confirmed confidentiality or availability effect; exploitation requires a valid Xtraction account, and no public exploit code has been identified at time of analysis. Upgrading to 2026.4 removes the vulnerable condition.
Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations.
Remote authenticated attackers can exploit an exposed dangerous method on the Core Server of Ivanti Endpoint Manager versions before 2024 SU6 to leak access credentials. The vulnerability requires valid authentication credentials to exploit and does not allow code execution or system modification, but compromises confidentiality by exposing sensitive authentication material that could facilitate lateral movement or account takeover.
Ivanti Secure Access Client before version 22.8R6 allows local authenticated users to read or modify sensitive log data through write access to a shared memory section due to incorrect permission assignments on a critical resource. With a CVSS score of 4.4 and a local attack vector requiring authentication, this vulnerability poses a moderate risk to users whose systems are accessed by multiple authenticated accounts. No active exploitation has been publicly confirmed, but the simplicity of the attack (local, low complexity) makes this a practical concern for multi-user systems.
Stored cross-site scripting (XSS) in Ivanti Neurons for ITSM (on-premise and cloud) before version 2025.4 allows authenticated remote attackers to inject malicious scripts that execute in other users' sessions, enabling limited information disclosure. User interaction is required to trigger the vulnerability. No public exploit code or active exploitation has been identified.
Ivanti Neurons for ITSM before version 2025.4 allows authenticated attackers to retain access to disabled accounts via an unprotected alternate authentication path, enabling persistent unauthorized information disclosure. The vulnerability affects both on-premise and cloud deployments and requires user interaction (UI:R), limiting but not eliminating real-world risk in multi-user environments where account disablement is a critical security control.
Authenticated attackers can exploit SQL injection in Ivanti Endpoint Manager prior to version 2024 SU5 to extract sensitive data from the underlying database. This network-accessible vulnerability requires valid credentials but allows unauthorized information disclosure with no user interaction needed. No patch is currently available for affected systems.
Ivanti Endpoint Manager fails to properly verify cryptographic signatures on patch and update packages processed by its patch management component (CWE-347), allowing a crafted package bearing a forged or invalid signature to be accepted and executed. Per the vendor CVSS vector (AV:L/AC:L/PR:N/UI:R), the attack requires delivery of a malicious update package to the affected component and a mandatory user-interaction step before arbitrary code executes, so it is not a hands-off remote exploit despite the description's 'remote' wording; only Endpoint Manager builds at or below 2024 SU4 (including 2024, SU1, SU2, SU3, SU3 SR1 and SU4) are affected. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV; a vendor fix is available in 2024 SU4 SR1 and later.
Path traversal in Ivanti Endpoint Manager 2024 through 2024 SU4 (including SU1, SU2, SU3, and SU3 Security Release 1) lets a remote attacker who already holds valid authenticated access, and who can also induce a legitimate user to perform an action, write arbitrary files outside the intended target directory on the EPM server. The two prerequisites - authenticated access (CVSS PR:L) plus required user interaction (CVSS UI:R) - substantially limit the exposure compared with an unauthenticated, fully automated attack, though the impact of a successful write is high (CVSS Integrity/High, Availability/High; vendor score 8.0, independent assessment 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is fixed in Ivanti Endpoint Manager 2024 SU4 SR1. This is a credible, above-average priority issue but not a drop-everything emergency based on current signals.
Arbitrary file write on the Ivanti Endpoint Manager server, exploitable by a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) when the victim performs an attacker-influenced action, with the potential to escalate to remote code execution on the EPM host. All EPM 2024 releases prior to 2024 SU4 SR1 are affected, including the 2024 base release through SU1, SU2, SU3, SU3 Security Release 1, and SU4. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), though the unauthenticated network vector combined with high confidentiality and integrity impact makes it a credible high-priority patch item; the mandatory user interaction (UI:R) is the principal limiting factor.
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3 Security Release 1) lets a remote unauthenticated attacker plant a persistent JavaScript payload that executes in the browser context of an administrator's EPM console session once that administrator views the poisoned page. Because the script runs inside an authenticated admin session, it can read or modify administrative data and perform actions as the victim, though the scope-limited CVSS impact (C:L/I:L/A:N) and the mandatory administrator interaction (UI:R) constrain the damage. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, but the EPSS score is elevated at 33.50% (98th percentile), indicating strong model-based likelihood of exploitation attempts; the vendor fix is Ivanti Endpoint Manager 2024 SU4 SR1.
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Path traversal in the administrative console of Ivanti Endpoint Manager Mobile (EPMM) allows an authenticated attacker holding administrator privileges to write files to unintended locations on the underlying disk, corrupting or overwriting data with high integrity impact and a limited availability effect. Only deployments running EPMM versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4 are affected, and exploitation requires a pre-existing admin session (CVSS PR:H), which sharply constrains real-world exposure - the practical risk is confined to environments where admin credentials are already compromised or where this is chained with a separate authentication-bypass flaw. At time of analysis there is no public exploit identified, EPSS is low at 0.62% (48th percentile), and the flaw is not listed in CISA KEV, making it a lower-tier priority despite the security-sensitive nature of the appliance.
Authenticated attackers holding administrator privileges on Ivanti EPMM can inject OS commands through the admin panel and execute arbitrary code on the underlying server in versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4. The flaw carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS probability of 20.35% (97th percentile), indicating elevated likelihood of exploitation activity, although no public exploit code or CISA KEV listing was identified at time of analysis. Because the prerequisite is an already-compromised administrative session, practical risk escalates where admin interfaces are reachable from untrusted networks or where credentials are reused.
Authenticated OS command injection in Ivanti Endpoint Manager Mobile (EPMM) allows a remote attacker with admin privileges to execute arbitrary OS commands and achieve remote code execution on versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4. Exploitation requires a valid admin session (CVSS PR:H), and no public exploit has been identified at time of analysis; however, the EPSS score is 20.35% (97th percentile), indicating elevated risk. The impact is high, with potential for full compromise of the EPMM server.
OS command injection in the administrative panel of Ivanti Endpoint Manager Mobile (EPMM) enables remote code execution for an attacker who already possesses an authenticated admin session. The flaw affects versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4; the CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N) because the high privilege prerequisite limits the attack surface. Despite the moderate base score, the EPSS score of 20.35% (97th percentile) indicates an unusually high exploitation probability, though no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote attacker who holds valid low-privilege credentials (PR:L, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read arbitrary data from the product's backend database; no user interaction or administrative rights are required, but network reachability to the EPM interface and an authenticated session are prerequisites, so realistic exposure is limited to insiders, compromised accounts, or consoles reachable by lower-trust users. The vendor rates the issue 6.5 (moderate) with high confidentiality impact only, and no public exploit code has been identified at time of analysis; EPSS is 0.82% (56th percentile), indicating low near-term exploitation likelihood, and the vulnerability is not confirmed actively exploited (not listed in CISA KEV).