40
CVEs
11
Critical
22
High
5
KEV
6
PoC
32
Unpatched C/H
2.5%
Patch Rate
4.7%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
22
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
Connect Secure
121
Endpoint Manager
99
Avalanche
98
Policy Secure
77
Pulse Connect Secure
45
Pulse Policy Secure
28
Workspace Control
18
Endpoint Manager Mobile
18
Zero Trust Access Gateway
17
Neurons For Secure Access
15
Secure Access Client
15
Pulse Secure Desktop Client
15
Neurons For Itsm
10
Cloud Services Appliance
7
Landesk Management Suite
6
Neurons For Zero Trust Access
5
Junos Pulse Secure Access Service
5
Endpoint Manager Cloud Services Appliance
5
Desktop Server Management
5
Ive Os
5
Ivanti Neurons For Itsm
3
Sentry
3
Incapptic Connect
3
Virtual Traffic Manager
3
Junos Pulse Access Control Service
3
Pulse Secure Desktop
3
Security Controls
3
Mobileiron
2
Enterprise Linux Atomic Host
2
Enterprise Linux Aus
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code. With EPSS 64.8% and KEV listing, this vulnerability in the mobile device management platform threatens the security of every managed mobile device in the organization, as EPMM has the ability to push configurations, certificates, and apps to enrolled devices. | CRITICAL | 9.8 | 64.8% | 199 |
KEV
PoC
|
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that allows unauthenticated attackers to achieve remote code execution on the mobile device management server. Compromising the MDM server provides access to all managed mobile device configurations, policies, and potentially the ability to push malicious profiles to enrolled devices. | CRITICAL | 9.8 | 50.9% | 185 |
KEV
PoC
No patch
|
| CVE-2026-1603 | Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet. | HIGH | 8.6 | 43.9% | 157 |
KEV
PoC
No patch
|
| CVE-2026-10520 | Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to achieve root-level command execution via OS command injection. With a maximum CVSS score of 10.0 and a network-accessible, no-interaction attack vector, this represents a critical exposure for any internet-facing Sentry appliance, though no public exploit has been identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 140 |
KEV
PoC
No patch
|
| CVE-2026-6973 | Remote code execution in Ivanti Endpoint Manager Mobile (EPMM) allows authenticated administrators to execute arbitrary code on the server. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 through improper input validation vulnerabilities. While requiring high-privilege administrator credentials (CVSS PR:H), the vulnerability enables complete system compromise once authenticated, with high impact to confidentiality, integrity, and availability. No public exploit or active exploitation confirmed at time of analysis. | HIGH | 7.2 | 5.0% | 131 |
KEV
PoC
No patch
|
| CVE-2026-10523 | Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative control of the appliance. Publicly available exploit code exists (watchTowr Labs PoC chained with CVE-2026-10520 for RCE), though it is not yet listed in CISA KEV; EPSS sits at a modest 0.31% (54th percentile) despite the critical CVSS 9.8 rating. | CRITICAL | 9.8 | 0.3% | 89 |
PoC
No patch
|
| CVE-2026-5787 | Certificate validation bypass in Ivanti Endpoint Manager Mobile (EPMM) allows remote unauthenticated attackers to impersonate registered Sentry hosts and fraudulently obtain CA-signed client certificates. Affects all versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. High-severity network attack (CVSS 8.9) with changed scope indicating potential pivot to additional systems. No active exploitation confirmed in CISA KEV at time of analysis, but Ivanti products are frequent targets requiring immediate patching priority. | HIGH | 8.9 | 0.0% | 65 |
No patch
|
| CVE-2026-5786 | Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) allows remote authenticated attackers with low-level credentials to gain full administrative access. Affected versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 contain an improper access control flaw (CWE-284) that enables credential-holding users to bypass authorization checks and assume administrative privileges. With CVSS 8.8 (High) and network-exploitable attack vector requiring only low privileges, this represents a significant risk for enterprise mobile device management environments, though EPSS data and active exploitation status are not available at time of analysis. | HIGH | 8.8 | 0.4% | 64 |
No patch
|
| CVE-2026-7821 | Improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) enables remote unauthenticated attackers to enroll restricted devices without authorization, exposing appliance configuration details and compromising enrolled device identity integrity. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. CVSS 7.4 with high attack complexity suggests exploitation requires specific timing or conditions. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though Ivanti products have been frequent targets of nation-state actors in recent years. | HIGH | 7.4 | 0.0% | 57 |
No patch
|
| CVE-2026-5788 | Remote unauthenticated attackers can invoke arbitrary methods in Ivanti Endpoint Manager Mobile (EPMM) via improper access control flaws, enabling authentication bypass and potential system compromise. Affects versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS vector indicates network-accessible exploitation with high attack complexity, resulting in high integrity impact and limited confidentiality/availability impact. No active exploitation confirmed via CISA KEV at time of analysis, though the authentication bypass tag and Ivanti's history of targeted attacks warrant elevated monitoring. | HIGH | 7.0 | 0.2% | 55 |
No patch
|
| CVE-2026-12647 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) allows an authenticated remote attacker to run arbitrary code on the server by abusing a missing authorization check (CWE-862). Because a low-privileged account is sufficient (CVSS:3.1 PR:L) and the flaw escapes its security scope (S:C) to fully compromise the host, Ivanti rated it 9.9 critical. No public exploit identified at time of analysis and it is not on CISA KEV, but this is one of a cluster of critical ITSM RCEs Ivanti disclosed in the same advisory. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12645 | Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12646 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) lets an authenticated attacker run arbitrary code on the server by reaching a function that fails to enforce authorization (CWE-862). Any low-privileged account is sufficient, and the CVSS 9.9 scope-change rating reflects that successful exploitation compromises confidentiality, integrity, and availability of the server and downstream components. No public exploit has been identified at time of analysis, but the vendor-issued advisory and 9.9 severity make this a top-priority patch item. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12650 | Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available. | CRITICAL | 9.9 | 1.5% | 50 |
No patch
|
| CVE-2026-12744 | Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch. | CRITICAL | 9.8 | 2.2% | 49 |
No patch
|