Ivanti
36 Ivanti flaws are on CISA's list of vulnerabilities attackers have used, 6 of them added in 2026. CISA says 12 are known to be used by ransomware. The latest was added Oct 13, 2026.
36on CISA's list, all time
6added in 2026
1in the last 90 days
12used by ransomware
18zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| Endpoint Manager Mobile (EPMM) | 7 | May 7, 2026 |
| Pulse Connect Secure | 7 | Nov 3, 2021 |
| Endpoint Manager (EPM) | 4 | Mar 10, 2025 |
| Cloud Services Appliance (CSA) | 3 | Oct 9, 2024 |
| Sentry | 2 | Jun 11, 2026 |
| Connect Secure, Policy Secure, and ZTA Gateways | 2 | Apr 4, 2025 |
| Connect Secure and Policy Secure | 2 | Jan 10, 2024 |
| Connect Secure | 1 | Oct 13, 2026 |
| Endpoint Manager (EPM) | 1 | Mar 9, 2026 |
| Virtual Traffic Manager | 1 | Sep 24, 2024 |
Latest Ivanti flaws
- Connect SecureIvanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- SentryIvanti Sentry OS Command Injection Vulnerability
- Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
- Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
- Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
- Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Connect Secure, Policy Secure, and ZTA GatewaysIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Connect Secure, Policy Secure, and ZTA GatewaysIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- Cloud Services Appliance (CSA)Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
- Cloud Services Appliance (CSA)Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.