# Ivanti vulnerabilities

Source: https://junglewise.ai/threats/vendors/ivanti  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/ivanti.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 81 vulnerabilities in Ivanti: 13 in the last 7 days and 32 in the last 90 days, 46 of them critical and 33 exploited in the wild. The most recent, CVE-2026-83528, was published on 10 November 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0, 3 exploited in the wild against 0. 14 technologies have a page of their own.

## Counts

- Last 7 days: 13
- Last 30 days: 15
- Last 90 days: 32
- All time: 81 (46 critical, 33 exploited in the wild)

## About Ivanti

An American software company that develops IT management, supply chain, and security solutions.

## Latest Ivanti vulnerabilities

- [CVE-2026-83528: Ivanti EPMM PII exposure vulnerability](https://junglewise.ai/threats/cve-2026-83528-exposure-of-pii-in-ivanti-epmm-before-version-12-10-0-1-12-9-0-3) (medium, CVSS 4.9, published 10 Nov 2026)
- [CVE-2026-107405: Ivanti EPMM exposed dangerous function denial of service](https://junglewise.ai/threats/cve-2026-107405-an-exposed-dangerous-function-in-ivanti-epmm-before-version-12) (medium, CVSS 5.5, published 10 Nov 2026)
- [CVE-2026-18128: Ivanti Endpoint Manager Agent cleartext transmission of credentials](https://junglewise.ai/threats/cve-2026-18128-cleartext-transmission-of-sensitive-information-in-the-agent-of) (medium, CVSS 6.8, published 10 Nov 2026)
- [CVE-2026-123181: Ivanti Sentry path traversal in administrative interface](https://junglewise.ai/threats/cve-2026-123181-a-path-traversal-vulnerability-in-ivanti-sentry-before-versions) (medium, CVSS 5.5, published 10 Nov 2026)
- [CVE-2026-123179: Ivanti Sentry insecure resource initialization in Tomcat shutdown listener](https://junglewise.ai/threats/cve-2026-123179-an-insecure-default-initialization-of-resource-in-the-tomcat) (medium, CVSS 5.5, published 10 Nov 2026)
- [CVE-2026-121683: Ivanti Cloud Services Application missing authentication in EPM certificate management](https://junglewise.ai/threats/cve-2026-121683-missing-authentication-in-ivanti-cloud-services-application) (critical, CVSS 9.4, published 10 Nov 2026)
- [CVE-2026-121653: Ivanti Endpoint Manager SQL injection in Core](https://junglewise.ai/threats/cve-2026-121653-sql-injection-in-the-core-of-ivanti-endpoint-manager-before) (critical, CVSS 9.8, published 10 Nov 2026)
- [CVE-2026-107404: Ivanti EPMM argument injection in file deletion](https://junglewise.ai/threats/cve-2026-107404-argument-injection-in-ivanti-epmm-before-version-12-10-0-1-12-9) (medium, CVSS 4.9, published 10 Nov 2026)
- [CVE-2026-105813: Ivanti UWM cleartext storage of session tokens](https://junglewise.ai/threats/cve-2026-105813-cleartext-storage-of-sensitive-information-in-ivanti-uwm-before) (medium, CVSS 6.3, published 10 Nov 2026)
- [CVE-2026-105669: Ivanti Sentry argument injection vulnerability](https://junglewise.ai/threats/cve-2026-105669-argument-injection-in-ivanti-sentry-before-version-10-8-3-and-10) (medium, CVSS 6.7, published 10 Nov 2026)
- [CVE-2026-105427: Ivanti EPMM improper input validation denial of service](https://junglewise.ai/threats/cve-2026-105427-improper-input-validation-in-ivanti-epmm-before-version-12-10-0) (medium, CVSS 4.9, published 10 Nov 2026)
- [CVE-2026-105426: Ivanti EPMM improper input validation kernel parameter modification](https://junglewise.ai/threats/cve-2026-105426-improper-input-validation-in-ivanti-epmm-before-version-12-10-0) (medium, CVSS 6.7, published 10 Nov 2026)
- [CVE-2026-105425: Ivanti Sentry and EPMM OS command injection](https://junglewise.ai/threats/cve-2026-105425-os-command-injection-in-ivanti-sentry-before-versions-10-7-4-10) (high, CVSS 7.2, published 10 Nov 2026)
- [CVE-2026-118527: Ivanti Connect Secure predictable identifier generation](https://junglewise.ai/threats/cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or) (critical, exploited in the wild, CVSS 4.3, published 3 Nov 2026)
- [CVE-2026-111357: Ivanti Connect Secure privilege escalation via DSCache configuration](https://junglewise.ai/threats/cve-2026-111357-ivanti-connect-secure-22-8r2-4-mishandles-the-manner-in-which) (critical, exploited in the wild, CVSS 7, published 15 Oct 2026)
- [CVE-2026-109412: Ivanti Neurons Patch for Intune exposed endpoint authentication information leak](https://junglewise.ai/threats/cve-2026-109412-an-exposed-dangerous-endpoint-in-ivanti-neurons-patch-for-intune) (critical, CVSS 9.9, published 13 Oct 2026)
- [CVE-2026-106047: Ivanti Xtraction path traversal in template export](https://junglewise.ai/threats/cve-2026-106047-a-path-traversal-vulnerability-in-the-template-export) (high, CVSS 7.7, published 13 Oct 2026)
- [CVE-2026-106043: Ivanti Xtraction missing authentication for critical function](https://junglewise.ai/threats/cve-2026-106043-a-missing-authentication-for-critical-function-vulnerability-in) (high, CVSS 7.5, published 13 Oct 2026)
- [CVE-2026-106042: Ivanti Xtraction path traversal in EPMM connector](https://junglewise.ai/threats/cve-2026-106042-an-external-control-of-file-name-or-path-vulnerability-in-ivanti) (critical, CVSS 9.9, published 13 Oct 2026)
- [CVE-2026-106035: Ivanti Xtraction Cloud Sync information exposure in log files](https://junglewise.ai/threats/cve-2026-106035-an-information-exposure-through-log-files-vulnerability-in) (medium, CVSS 5.5, published 13 Oct 2026)
- [CVE-2026-106034: Ivanti Xtraction path traversal vulnerability](https://junglewise.ai/threats/cve-2026-106034-a-path-traversal-vulnerability-in-ivanti-xtraction-before) (medium, CVSS 5, published 13 Oct 2026)
- [CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-104935-ivanti-connect-secure-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 8.6, published 13 Oct 2026)
- [CVE-2026-83527: Ivanti Sentry authentication bypass](https://junglewise.ai/threats/cve-2026-83527-ivanti-sentry-authentication-bypass) (high, CVSS 8.1, published 8 Sep 2026)
- [CVE-2026-18851: Ivanti Endpoint Manager Mobile privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-18851-ivanti-endpoint-manager-mobile-privilege-escalation-via-missing) (high, CVSS 8.8, published 8 Sep 2026)
- [CVE-2026-12745: Ivanti Neurons for ITSM deserialization vulnerability](https://junglewise.ai/threats/cve-2026-12745-ivanti-neurons-for-itsm-deserialization-vulnerability) (critical, CVSS 9.8, published 8 Sep 2026)

## Most severe Ivanti vulnerabilities

- [CVE-2026-10520: Ivanti Sentry OS command injection allows remote code execution](https://junglewise.ai/threats/cve-2026-10520-ivanti-sentry-os-command-injection-allows-remote-code-execution) (critical, exploited in the wild, CVSS 10, published 9 Jun 2026)
- [CVE-2026-1281: Ivanti Endpoint Manager Mobile code injection remote code execution](https://junglewise.ai/threats/cve-2026-1281-ivanti-endpoint-manager-mobile-code-injection-remote-code) (critical, exploited in the wild, CVSS 9.8, published 29 Jan 2026)
- [CVE-2026-1340: Ivanti Endpoint Manager Mobile code injection](https://junglewise.ai/threats/cve-2026-1340-ivanti-endpoint-manager-mobile-code-injection) (critical, exploited in the wild, CVSS 9.8, published 8 Apr 2026)
- [CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2025-22457-ivanti-connect-secure-policy-secure-and-zta-gateways-stack-based) (critical, exploited in the wild, CVSS 9.8, published 4 Apr 2025)
- [CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-13161-ivanti-endpoint-manager-epm-absolute-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 10 Mar 2025)
- [CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-13160-ivanti-endpoint-manager-epm-absolute-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 10 Mar 2025)
- [CVE-2024-13159: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-13159-ivanti-endpoint-manager-epm-absolute-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 10 Mar 2025)
- [CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-7593-ivanti-virtual-traffic-manager-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 24 Sep 2024)
- [CVE-2021-44529: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability](https://junglewise.ai/threats/cve-2021-44529-ivanti-endpoint-manager-cloud-service-appliance-epm-csa-code) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2024)
- [CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2023-35082-ivanti-endpoint-manager-mobile-epmm-and-mobileiron-core) (critical, exploited in the wild, CVSS 9.8, published 18 Jan 2024)

## Vulnerabilities per week

9 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0, 3 exploited in the wild against 0.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 10 | 6 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 8 | 4 | 2 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 1 |
| 9 Nov 2026 | 13 | 2 | 0 |

## Ivanti technologies

- [Ivanti Endpoint Manager Mobile](https://junglewise.ai/threats/technologies/endpoint-manager-mobile): 11 vulnerabilities
- [Ivanti Sentry](https://junglewise.ai/threats/technologies/sentry): 10 vulnerabilities
- [Ivanti Connect Secure](https://junglewise.ai/threats/technologies/connect-secure): 9 vulnerabilities
- [Ivanti Endpoint Manager Mobile (EPMM)](https://junglewise.ai/threats/technologies/endpoint-manager-mobile-epmm): 9 vulnerabilities
- [Ivanti Neurons-For-Itsm](https://junglewise.ai/threats/technologies/neurons-for-itsm): 9 vulnerabilities
- [Ivanti Endpoint Manager (EPM)](https://junglewise.ai/threats/technologies/endpoint-manager-epm): 8 vulnerabilities
- [Ivanti MobileIron Core](https://junglewise.ai/threats/technologies/mobileiron-core): 8 vulnerabilities
- [Ivanti Endpoint Manager](https://junglewise.ai/threats/technologies/endpoint-manager): 7 vulnerabilities
- [Ivanti Xtraction](https://junglewise.ai/threats/technologies/xtraction): 7 vulnerabilities
- [Ivanti EPMM](https://junglewise.ai/threats/technologies/epmm): 6 vulnerabilities
- [Ivanti Policy Secure](https://junglewise.ai/threats/technologies/policy-secure): 5 vulnerabilities
- [Ivanti Cloud Services Appliance (CSA)](https://junglewise.ai/threats/technologies/cloud-services-appliance-csa): 4 vulnerabilities
- [Ivanti Secure Access Client](https://junglewise.ai/threats/technologies/secure-access-client): 4 vulnerabilities
- [Ivanti Neurons](https://junglewise.ai/threats/technologies/neurons): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Ivanti vulnerabilities", https://junglewise.ai/threats/vendors/ivanti, 13 November 2026.