ivanti security advisories
27 threat alerts tracking vulnerabilities and security advisories that affect ivanti products.
Vulnios monitors ivanti CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent ivanti security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-29847 — ivanti — endpoint_manager
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
criticalCVE-2024-29847Critical Vulnerability: CVE-2024-50330 — ivanti — endpoint_manager
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution.
criticalCVE-2024-50330Critical Vulnerability: CVE-2026-8043 — ivanti — xtraction
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to i
criticalCVE-2026-8043Critical Vulnerability: CVE-2025-10573 — ivanti — endpoint_manager
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interactio
criticalCVE-2025-10573Critical Vulnerability: CVE-2025-0282 — ivanti — connect_secure, neurons_for_zero-trust_access
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remot
criticalCVE-2025-0282Critical Vulnerability: CVE-2026-12645 — ivanti — neurons_for_itsm
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12645Critical Vulnerability: CVE-2026-12745 — ivanti — neurons_for_itsm
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12745Critical Vulnerability: CVE-2026-12650 — ivanti — neurons_for_itsm
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12650Critical Vulnerability: CVE-2026-12647 — ivanti — neurons_for_itsm
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12647Critical Vulnerability: CVE-2026-12744 — ivanti — neurons_for_itsm
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12744Critical Vulnerability: CVE-2026-12646 — ivanti — neurons_for_itsm
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
criticalCVE-2026-12646Critical Vulnerability: CVE-2021-42128 — ivanti — avalanche
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service.
criticalCVE-2021-42128Critical Vulnerability: CVE-2021-42127 — ivanti — avalanche
A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.
criticalCVE-2021-42127Critical Vulnerability: CVE-2020-13774 — ivanti — endpoint_manager
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx
criticalCVE-2020-13774Critical Vulnerability: CVE-2020-13793 — ivanti — dsm_netinst
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
criticalCVE-2020-13793Critical Vulnerability: CVE-2020-12441 — ivanti — desktop\&server_management, service_manager_heat_remote_control
Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specia
criticalCVE-2020-12441Critical Vulnerability: CVE-2020-12442 — ivanti — avalanche
Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.
criticalCVE-2020-12442Critical Vulnerability: CVE-2019-16382 — ivanti — workspace_control
An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid X
criticalCVE-2019-16382Critical Vulnerability: CVE-2019-10651 — ivanti — endpoint_manager
An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In other words, the issue affects 2017.3, 2018.1
criticalCVE-2019-10651Critical Vulnerability: CVE-2018-20810 — ivanti, pulsesecure — connect_secure, pulse_policy_secure
Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4
criticalCVE-2018-20810Critical Vulnerability: CVE-2018-20813 — ivanti — connect_secure
An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2.
criticalCVE-2018-20813Critical Vulnerability: CVE-2019-12377 — ivanti — landesk_management_suite
A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary
criticalCVE-2019-12377Critical Vulnerability: CVE-2019-12373 — ivanti — landesk_management_suite
Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote disclosure of administrator passwords.
criticalCVE-2019-12373Critical Vulnerability: CVE-2019-11540 — ivanti, pulsesecure — connect_secure, pulse_connect_secure
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote att
criticalCVE-2019-11540Critical Vulnerability: CVE-2018-6320 — ivanti, pulsesecure — connect_secure, pulse_connect_secure
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before
criticalCVE-2018-6320Critical Vulnerability: CVE-2016-3147 — ivanti — landesk_management_suite
Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a larg
criticalCVE-2016-3147Critical Vulnerability: CVE-2016-4787 — ivanti, pulsesecure — connect_secure, pulse_connect_secure
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directo
criticalCVE-2016-4787
Track ivanti exposure across your environment
Vulnios automatically cross-references your asset inventory against new ivanti CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan