Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

Ivanti: actively exploited vulnerabilities

36 vulnerabilities in Ivanti products are listed in CISA’s catalog of actively exploited vulnerabilities, 12 of them used by ransomware. Latest addition on October 13, 2026: CVE-2026-104935 (Connect Secure).

Affected products

  • Endpoint Manager Mobile (EPMM)7
  • Pulse Connect Secure7
  • Endpoint Manager (EPM)5
  • Cloud Services Appliance (CSA)3
  • Connect Secure and Policy Secure2
  • Connect Secure, Policy Secure, and ZTA Gateways2
  • Sentry2
  • Cloud Services Appliance1
  • Connect Secure1
  • Connect Secure, Policy Secure, and Neurons1
  • Endpoint Manager Cloud Service Appliance (EPM CSA)1
  • Endpoint Manager Mobile (EPMM) and MobileIron Core1
  • MobileIron Multiple Products1
  • Pulse Connect Secure and Pulse Policy Secure1
  • Virtual Traffic Manager1

Our analyses

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2026-ALE-001

    [MàJ] Multiples vulnérabilités dans Ivanti Endpoint Manager Mobile (30 janvier 2026)

  2. CERTFR-2025-ALE-007

    Multiples vulnérabilités dans Ivanti Endpoint Manager Mobile (EPMM) (14 mai 2025)

  3. CERTFR-2025-ALE-003

    [MàJ] Vulnérabilité dans les produits Ivanti (03 avril 2025)

  4. CERTFR-2025-ALE-001

    [MàJ] Vulnérabilité dans les produits Ivanti (09 janvier 2025)

  5. CERTFR-2024-ALE-013

    Exploitations de vulnérabilités dans Ivanti Cloud Services Appliance (CSA) (22 octobre 2024)

  6. CERTFR-2024-ALE-001

    [MàJ] Multiples vulnérabilités dans Ivanti Connect Secure et Policy Secure Gateways (11 janvier 2024)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 6 vulnerabilities

  1. CVE-2026-104935

    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

    Mentioned in our article: Ivanti Connect Secure zero-day exploited, one of the patches still pending

    NVD entryCISA catalog

  2. CVE-2026-10520

    Ivanti Sentry OS Command Injection Vulnerability

    NVD entryCISA catalog

  3. CVE-2026-6973

    Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

    NVD entryCISA catalog

  4. CVE-2026-1340

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    NVD entryCISA catalog

  5. CVE-2026-1603

    Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

    NVD entryCISA catalog

  6. CVE-2026-1281

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    NVD entryCISA catalog

2025 7 vulnerabilities

  1. CVE-2025-4428

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2025-4427

    Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

    NVD entryCISA catalog

  3. CVE-2025-22457Used by ransomware

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

    NVD entryCISA catalog

  4. CVE-2024-13161

    Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

    NVD entryCISA catalog

  5. CVE-2024-13160

    Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

    NVD entryCISA catalog

  6. CVE-2024-13159

    Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

    NVD entryCISA catalog

  7. CVE-2025-0282Used by ransomware

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

    NVD entryCISA catalog

2024 11 vulnerabilities

  1. CVE-2024-9380

    Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2024-9379

    Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

    NVD entryCISA catalog

  3. CVE-2024-29824

    Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

    NVD entryCISA catalog

  4. CVE-2024-7593

    Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

    NVD entryCISA catalog

  5. CVE-2024-8963

    Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

    NVD entryCISA catalog

  6. CVE-2024-8190

    Ivanti Cloud Services Appliance OS Command Injection Vulnerability

    NVD entryCISA catalog

  7. CVE-2021-44529Used by ransomware

    Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

    NVD entryCISA catalog

  8. CVE-2024-21893Used by ransomware

    Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

    NVD entryCISA catalog

  9. CVE-2023-35082Used by ransomware

    Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

    NVD entryCISA catalog

  10. CVE-2024-21887Used by ransomware

    Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

    NVD entryCISA catalog

  11. CVE-2023-46805Used by ransomware

    Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

    NVD entryCISA catalog

2023 3 vulnerabilities

  1. CVE-2023-38035Used by ransomware

    Ivanti Sentry Authentication Bypass Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-35081

    Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

    NVD entryCISA catalog

  3. CVE-2023-35078Used by ransomware

    Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

    NVD entryCISA catalog

2021 9 vulnerabilities

  1. CVE-2021-22900

    Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

    NVD entryCISA catalog

  2. CVE-2021-22899

    Ivanti Pulse Connect Secure Command Injection Vulnerability

    NVD entryCISA catalog

  3. CVE-2021-22894

    Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

    NVD entryCISA catalog

  4. CVE-2021-22893Used by ransomware

    Ivanti Pulse Connect Secure Use-After-Free Vulnerability

    NVD entryCISA catalog

  5. CVE-2020-8260

    Ivanti Pulse Connect Secure Code Execution Vulnerability

    NVD entryCISA catalog

  6. CVE-2020-8243

    Ivanti Pulse Connect Secure Code Execution Vulnerability

    NVD entryCISA catalog

  7. CVE-2020-15505

    Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

    NVD entryCISA catalog

  8. CVE-2019-11539Used by ransomware

    Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

    NVD entryCISA catalog

  9. CVE-2019-11510Used by ransomware

    Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.