15
CVEs
6
Critical
7
High
0
KEV
0
PoC
13
Unpatched C/H
0.0%
Patch Rate
1.2%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
7
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Connect Secure
121
Endpoint Manager
99
Avalanche
98
Policy Secure
77
Pulse Connect Secure
45
Pulse Policy Secure
28
Workspace Control
18
Endpoint Manager Mobile
18
Zero Trust Access Gateway
17
Neurons For Secure Access
15
Secure Access Client
15
Pulse Secure Desktop Client
15
Neurons For Itsm
10
Cloud Services Appliance
7
Landesk Management Suite
6
Neurons For Zero Trust Access
5
Junos Pulse Secure Access Service
5
Endpoint Manager Cloud Services Appliance
5
Desktop Server Management
5
Ive Os
5
Ivanti Neurons For Itsm
3
Sentry
3
Incapptic Connect
3
Virtual Traffic Manager
3
Junos Pulse Access Control Service
3
Pulse Secure Desktop
3
Security Controls
3
Mobileiron
2
Enterprise Linux Atomic Host
2
Enterprise Linux Aus
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-12647 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) allows an authenticated remote attacker to run arbitrary code on the server by abusing a missing authorization check (CWE-862). Because a low-privileged account is sufficient (CVSS:3.1 PR:L) and the flaw escapes its security scope (S:C) to fully compromise the host, Ivanti rated it 9.9 critical. No public exploit identified at time of analysis and it is not on CISA KEV, but this is one of a cluster of critical ITSM RCEs Ivanti disclosed in the same advisory. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12645 | Remote authenticated arbitrary code execution affects Ivanti Neurons for ITSM before 2026.2, where a missing authorization check (CWE-862) lets a low-privileged authenticated user reach functionality that executes code on the server. Rated CVSS 9.9 with a scope-change vector, it grants full confidentiality, integrity, and availability compromise of the ITSM host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (2026.2) is available. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12646 | Remote code execution in Ivanti Neurons for ITSM (all versions before 2026.2) lets an authenticated attacker run arbitrary code on the server by reaching a function that fails to enforce authorization (CWE-862). Any low-privileged account is sufficient, and the CVSS 9.9 scope-change rating reflects that successful exploitation compromises confidentiality, integrity, and availability of the server and downstream components. No public exploit has been identified at time of analysis, but the vendor-issued advisory and 9.9 severity make this a top-priority patch item. | CRITICAL | 9.9 | 1.2% | 50 |
No patch
|
| CVE-2026-12650 | Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available. | CRITICAL | 9.9 | 1.5% | 50 |
No patch
|
| CVE-2026-12744 | Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch. | CRITICAL | 9.8 | 2.2% | 49 |
No patch
|
| CVE-2026-12745 | Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 2.1% | 49 |
No patch
|
| CVE-2026-18851 | Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. No public exploit code or CISA KEV listing is identified at time of analysis, but Ivanti EPMM has a well-documented history of targeted exploitation in prior CVE cycles. | HIGH | 8.8 | 1.0% | 44 |
No patch
|
| CVE-2026-12648 | Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 1.5% | 44 |
No patch
|
| CVE-2026-12651 | Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention. | HIGH | 8.8 | 1.5% | 44 |
No patch
|
| CVE-2026-18129 | Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; however, the network-accessible attack surface and high-value credential target make this a meaningful priority for organizations running EPM in network environments with untrusted segments. | HIGH | 8.1 | 0.9% | 41 |
No patch
|
| CVE-2026-83527 | Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. No public exploit or CISA KEV listing is associated at time of analysis, though the vendor self-disclosed via a security advisory, and the all-high C:H/I:H/A:H impact from administrative compromise makes this a critical patching priority for enterprises running Sentry in mobile security gateway roles. | HIGH | 8.1 | 1.5% | 40 |
No patch
|
| CVE-2026-18127 | Full write control over configured S3 session recording buckets is achievable in Ivanti Endpoint Manager (EPM) before version 2024 SU7 by remote authenticated attackers exploiting a CWE-73 filename control flaw. The Core component fails to sanitize user-supplied input used to construct S3 object paths, enabling any low-privilege authenticated EPM user to write arbitrary data to the session recording bucket - potentially overwriting or corrupting forensic evidence. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available as EPM 2024 SU7. | HIGH | 7.7 | 0.4% | 39 |
No patch
|
| CVE-2026-18125 | Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence. | HIGH | 7.5 | 0.8% | 38 |
No patch
|
| CVE-2026-14903 | Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided. | MEDIUM | 6.5 | 1.0% | 34 |
No patch
|
| CVE-2026-14902 | Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations. | MEDIUM | 6.1 | 0.5% | 31 |
No patch
|