490
CVEs
94
Critical
287
High
34
KEV
63
PoC
367
Unpatched C/H
3.9%
Patch Rate
14.1%
Avg EPSS
Severity Breakdown
CRITICAL
94
HIGH
287
MEDIUM
104
LOW
5
Monthly CVE Trend
Affected Products (30)
Connect Secure
121
Endpoint Manager
99
Avalanche
98
Policy Secure
77
Pulse Connect Secure
45
Pulse Policy Secure
28
Workspace Control
18
Endpoint Manager Mobile
18
Zero Trust Access Gateway
17
Neurons For Secure Access
15
Secure Access Client
15
Pulse Secure Desktop Client
15
Neurons For Itsm
10
Cloud Services Appliance
7
Landesk Management Suite
6
Neurons For Zero Trust Access
5
Junos Pulse Secure Access Service
5
Endpoint Manager Cloud Services Appliance
5
Desktop Server Management
5
Ive Os
5
Ivanti Neurons For Itsm
3
Sentry
3
Incapptic Connect
3
Virtual Traffic Manager
3
Junos Pulse Access Control Service
3
Pulse Secure Desktop
3
Security Controls
3
Mobileiron
2
Enterprise Linux Atomic Host
2
Enterprise Linux Aus
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administrators to execute arbitrary commands, chained with CVE-2023-46805 for unauthenticated RCE. | CRITICAL | 9.1 | 94.4% | 235 |
KEV
PoC
No patch
|
| CVE-2021-44529 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 99.1% | 233 |
KEV
PoC
|
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated access to restricted resources, chained with CVE-2024-21887 for unauthenticated RCE in massive exploitation campaigns starting January 2024. | HIGH | 8.2 | 94.4% | 230 |
KEV
PoC
No patch
|
| CVE-2024-21893 | Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis. | HIGH | 8.2 | 94.3% | 230 |
KEV
PoC
No patch
|
| CVE-2023-35078 | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 100.0% | 219 |
KEV
PoC
No patch
|
| CVE-2024-7593 | Authentication bypass in Ivanti Virtual Traffic Manager (vTM) admin panel allows remote unauthenticated attackers to gain administrative access to the appliance due to a flawed authentication algorithm implementation. The flaw is confirmed actively exploited (CISA KEV) with an EPSS score of 94.44% (100th percentile), placing it among the highest-risk vulnerabilities currently tracked. All vTM releases other than 22.2R1 and 22.7R2 are affected. | CRITICAL | 9.8 | 94.4% | 213 |
KEV
PoC
|
| CVE-2024-13159 | Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to leak sensitive information from the EPM server, one of three related Ivanti EPM path traversal CVEs. | CRITICAL | 9.8 | 94.2% | 213 |
KEV
PoC
No patch
|
| CVE-2024-13160 | Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosure, part of the triple path traversal affecting EPM's January 2025 security update. | CRITICAL | 9.8 | 93.5% | 212 |
KEV
PoC
No patch
|
| CVE-2024-13161 | Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosure, completing the triple path traversal set in the January 2025 security update. | CRITICAL | 9.8 | 92.5% | 212 |
KEV
PoC
No patch
|
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated remote code execution, the second major Ivanti VPN zero-day in twelve months. | CRITICAL | 9.0 | 94.1% | 209 |
KEV
PoC
No patch
|
| CVE-2025-4427 | An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | MEDIUM | 5.3 | 91.6% | 203 |
KEV
PoC
No patch
|
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code. With EPSS 64.8% and KEV listing, this vulnerability in the mobile device management platform threatens the security of every managed mobile device in the organization, as EPMM has the ability to push configurations, certificates, and apps to enrolled devices. | CRITICAL | 9.8 | 64.8% | 199 |
KEV
PoC
|
| CVE-2025-22457 | Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA Gateways (before 22.8R2.2) lets a remote unauthenticated attacker overflow a stack buffer to run arbitrary code on the appliance. This flaw is confirmed actively exploited (CISA KEV), with publicly available exploit code and reporting of a suspected China-nexus threat actor, and it carries an elevated EPSS of 53.66% (98th percentile), placing it among the highest-risk internet-facing edge-device vulnerabilities. | CRITICAL | 9.8 | 53.7% | 188 |
KEV
PoC
No patch
|
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that allows unauthenticated attackers to achieve remote code execution on the mobile device management server. Compromising the MDM server provides access to all managed mobile device configurations, policies, and potentially the ability to push malicious profiles to enrolled devices. | CRITICAL | 9.8 | 50.9% | 185 |
KEV
PoC
No patch
|
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) contains an authenticated code injection in the API component, allowing authenticated attackers to execute arbitrary code through crafted API requests. | HIGH | 7.2 | 45.3% | 166 |
KEV
PoC
No patch
|