10
CVEs
6
Critical
4
High
0
KEV
0
PoC
10
Unpatched C/H
0.0%
Patch Rate
1.5%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Connect Secure
121
Endpoint Manager
99
Avalanche
98
Policy Secure
77
Pulse Connect Secure
45
Pulse Policy Secure
28
Workspace Control
18
Endpoint Manager Mobile
18
Zero Trust Access Gateway
17
Neurons For Secure Access
15
Secure Access Client
15
Pulse Secure Desktop Client
15
Neurons For Itsm
10
Cloud Services Appliance
7
Landesk Management Suite
6
Neurons For Zero Trust Access
5
Junos Pulse Secure Access Service
5
Endpoint Manager Cloud Services Appliance
5
Desktop Server Management
5
Ive Os
5
Ivanti Neurons For Itsm
3
Sentry
3
Incapptic Connect
3
Virtual Traffic Manager
3
Junos Pulse Access Control Service
3
Pulse Secure Desktop
3
Security Controls
3
Mobileiron
2
Enterprise Linux Atomic Host
2
Enterprise Linux Aus
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-12647 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) allows an authenticated remote attacker to run arbitrary code on the server by abusing a missing authorization check (CWE-862). Because a low-privileged account is sufficient (CVSS:3.1 PR:L) and the flaw escapes its security scope (S:C) to fully compromise the host, Ivanti rated it 9.9 critical. No public exploit identified at time of analysis and it is not on CISA KEV, but this is one of a cluster of critical ITSM RCEs Ivanti disclosed in the same advisory. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12645 | Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12646 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) lets an authenticated attacker run arbitrary code on the server by reaching a function that fails to enforce authorization (CWE-862). Any low-privileged account is sufficient, and the CVSS 9.9 scope-change rating reflects that successful exploitation compromises confidentiality, integrity, and availability of the server and downstream components. No public exploit has been identified at time of analysis, but the vendor-issued advisory and 9.9 severity make this a top-priority patch item. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12650 | Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available. | CRITICAL | 9.9 | 1.5% | 50 |
No patch
|
| CVE-2026-12744 | Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch. | CRITICAL | 9.8 | 2.2% | 49 |
No patch
|
| CVE-2026-12745 | Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 2.1% | 49 |
No patch
|
| CVE-2026-18851 | Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. No public exploit code or CISA KEV listing is identified at time of analysis, but Ivanti EPMM has a well-documented history of targeted exploitation in prior CVE cycles. | HIGH | 8.8 | 1.0% | 44 |
No patch
|
| CVE-2026-12648 | Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 1.5% | 44 |
No patch
|
| CVE-2026-12651 | Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention. | HIGH | 8.8 | 1.5% | 44 |
No patch
|
| CVE-2026-83527 | Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. No public exploit or CISA KEV listing is associated at time of analysis, though the vendor self-disclosed via a security advisory, and the all-high C:H/I:H/A:H impact from administrative compromise makes this a critical patching priority for enterprises running Sentry in mobile security gateway roles. | HIGH | 8.1 | 1.5% | 40 |
No patch
|