Ivanti
First CVE: Aug 13, 2024Active for: 2 years
193
CVEs Published
More CVEs Published than 79% of tracked CNAs
64.3
Avg CVEs / Year
More Avg CVEs / Year than 85% of tracked CNAs
7.4
Avg CVSS Score
Higher Avg CVSS Score than 62% of tracked CNAs
8.8%
In CISA KEV
Higher KEV Rate than 97% of tracked CNAs
Self-Reporting Analysis
Of all the CVEs published by Ivanti as a CNA, 96.9% affect products that Ivanti develops as a vendor.
96.9%
Self-reported: 187Third-party: 6
Of all the CVEs published that affect products developed by Ivanti, 37.9% are self-published by Ivanti as a CNA.
37.9%
62.1%
Self-published: 187Published by other CNAs: 307
Trends Over Time
The number and severity of CVEs published by Ivanti over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 13, 2024
23 months ago
Most Recent CVE
Jul 14, 2026
10 days ago
Top CVEs
All CVEs published by Ivanti as a CNA, regardless of affected vendor or product.
193 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-10520CRITICAL An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execu | Jun 9, 2026 | 10.0 | 99 | YES | YES |
CVE-2025-22457CRITICAL A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows | Apr 3, 2025 | 9.8 | 99 | YES | YES |
CVE-2026-1340CRITICAL A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | Jan 29, 2026 | 9.8 | 98 | YES | YES |
CVE-2025-4427HIGH An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the | May 13, 2025 | 7.5 | 98 | YES | YES |
CVE-2025-0282CRITICAL A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22. | Jan 8, 2025 | 9.0 | 98 | YES | YES |
CVE-2024-8963CRITICAL Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | Sep 19, 2024 | 9.1 | 98 | YES | YES |
CVE-2024-7593CRITICAL Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the | Aug 13, 2024 | 9.8 | 98 | YES | YES |
CVE-2026-1603HIGH An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | Feb 10, 2026 | 7.5 | 97 | YES | YES |
CVE-2026-1281CRITICAL A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | Jan 29, 2026 | 9.8 | 97 | YES | YES |
CVE-2024-13159HIGH Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensit | Jan 14, 2025 | 7.5 | 97 | YES | YES |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA193 CVEs
24%
63%
11%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local53 (27.5%)
Network140 (72.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low186 (96.4%)
High7 (3.6%)
Unknown0 (0.0%)
User Interaction
None169 (87.6%)
Unknown0 (0.0%)
Required24 (12.4%)
Privileges Required
Low77 (39.9%)
High45 (23.3%)
None71 (36.8%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (193 CVEs).
CISA KEV
17 CVEs
8.8% of CVEs· 97th percentile
Metasploit
6 CVEs
3.1% of CVEs· 95th percentile
Nuclei
10 CVEs
5.2% of CVEs· 93rd percentile
ExploitDB
2 CVEs
1.0% of CVEs· 83rd percentile
Social Chatter
An overview of all social media posts that mention a CVE ID published by Ivanti as a CNA.
Media Mentions
Media articles that mention a CVE ID published by Ivanti as a CNA — matched by CVE ID, not by organization name.