--- title: "Ivanti: known exploited vulnerabilities" url: https://erroneo.us/security/vendor/ivanti/ description: "Every Ivanti vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (24), newest first, with due dates and fixes." type: vendor section: "Security Digest" date_modified: 2026-10-13 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Ivanti: known exploited vulnerabilities - 2026-10-13 [CVE-2026-104935](https://erroneo.us/security/cve/CVE-2026-104935/index.md) Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (due 2026-10-16; ransomware: Unknown) - 2026-06-11 [CVE-2026-10520](https://erroneo.us/security/cve/CVE-2026-10520/index.md) Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability (due 2026-06-14; ransomware: Unknown) - 2026-05-07 [CVE-2026-6973](https://erroneo.us/security/cve/CVE-2026-6973/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (due 2026-05-10; ransomware: Unknown) - 2026-04-08 [CVE-2026-1340](https://erroneo.us/security/cve/CVE-2026-1340/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (due 2026-04-11; ransomware: Unknown) - 2026-03-09 [CVE-2026-1603](https://erroneo.us/security/cve/CVE-2026-1603/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (due 2026-03-23; ransomware: Unknown) - 2026-01-29 [CVE-2026-1281](https://erroneo.us/security/cve/CVE-2026-1281/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (due 2026-02-01; ransomware: Unknown) - 2025-05-19 [CVE-2025-4428](https://erroneo.us/security/cve/CVE-2025-4428/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (due 2025-06-09; ransomware: Unknown) - 2025-05-19 [CVE-2025-4427](https://erroneo.us/security/cve/CVE-2025-4427/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability (due 2025-06-09; ransomware: Unknown) - 2025-04-04 [CVE-2025-22457](https://erroneo.us/security/cve/CVE-2025-22457/index.md) Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (due 2025-04-11; ransomware: Known) - 2025-03-10 [CVE-2024-13161](https://erroneo.us/security/cve/CVE-2024-13161/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (due 2025-03-31; ransomware: Unknown) - 2025-03-10 [CVE-2024-13160](https://erroneo.us/security/cve/CVE-2024-13160/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (due 2025-03-31; ransomware: Unknown) - 2025-03-10 [CVE-2024-13159](https://erroneo.us/security/cve/CVE-2024-13159/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (due 2025-03-31; ransomware: Unknown) - 2025-01-08 [CVE-2025-0282](https://erroneo.us/security/cve/CVE-2025-0282/index.md) Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (due 2025-01-15; ransomware: Known) - 2024-10-09 [CVE-2024-9380](https://erroneo.us/security/cve/CVE-2024-9380/index.md) Ivanti Cloud Services Appliance (CSA): Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability (due 2024-10-30; ransomware: Unknown) - 2024-10-09 [CVE-2024-9379](https://erroneo.us/security/cve/CVE-2024-9379/index.md) Ivanti Cloud Services Appliance (CSA): Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability (due 2024-10-30; ransomware: Unknown) - 2024-10-02 [CVE-2024-29824](https://erroneo.us/security/cve/CVE-2024-29824/index.md) Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability (due 2024-10-23; ransomware: Unknown) - 2024-09-24 [CVE-2024-7593](https://erroneo.us/security/cve/CVE-2024-7593/index.md) Ivanti Virtual Traffic Manager: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability (due 2024-10-15; ransomware: Unknown) - 2024-09-19 [CVE-2024-8963](https://erroneo.us/security/cve/CVE-2024-8963/index.md) Ivanti Cloud Services Appliance (CSA): Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability (due 2024-10-10; ransomware: Unknown) - 2024-09-13 [CVE-2024-8190](https://erroneo.us/security/cve/CVE-2024-8190/index.md) Ivanti Cloud Services Appliance: Ivanti Cloud Services Appliance OS Command Injection Vulnerability (due 2024-10-04; ransomware: Unknown) - 2024-03-25 [CVE-2021-44529](https://erroneo.us/security/cve/CVE-2021-44529/index.md) Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA): Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability (due 2024-04-15; ransomware: Known) - 2024-01-31 [CVE-2024-21893](https://erroneo.us/security/cve/CVE-2024-21893/index.md) Ivanti Connect Secure, Policy Secure, and Neurons: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability (due 2024-02-02; ransomware: Known) - 2024-01-18 [CVE-2023-35082](https://erroneo.us/security/cve/CVE-2023-35082/index.md) Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability (due 2024-02-08; ransomware: Known) - 2024-01-10 [CVE-2024-21887](https://erroneo.us/security/cve/CVE-2024-21887/index.md) Ivanti Connect Secure and Policy Secure: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability (due 2024-01-22; ransomware: Known) - 2024-01-10 [CVE-2023-46805](https://erroneo.us/security/cve/CVE-2023-46805/index.md) Ivanti Connect Secure and Policy Secure: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability (due 2024-01-22; ransomware: Known) --- Source page: https://erroneo.us/security/vendor/ivanti/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt