{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Ivanti vulnerabilities","home_page_url":"https://patchfirst.co/vendor/ivanti/","feed_url":"https://patchfirst.co/feed/vendor/ivanti.json","description":"New and newly exploited Ivanti CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-111357#kev","url":"https://patchfirst.co/cve/CVE-2026-111357/","title":"[KEV] CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. ENISA EUVD lists it as exploited. EPSS 0.3% (higher than 24.6% of CVEs). CVSS 7.0 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism. Priority 57.0 of 100.","summary":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-31T04:18:16.000Z","tags":["kev","T1068","T1548"],"_patchfirst":{"reason":"kev","priority":57,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":{"score":0.00316,"percentile":0.24569},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1068","T1548"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-118527#kev","url":"https://patchfirst.co/cve/CVE-2026-118527/","title":"[KEV] CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-30. No EPSS score. ATT&CK: T1190 Exploit Public-Facing Application; T1105 Ingress Tool Transfer. Priority 45.0 of 100.","summary":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T00:00:00.000Z","tags":["kev","T1190","T1105"],"_patchfirst":{"reason":"kev","priority":45,"kev":{"dateAdded":"2026-10-30","ransomware":false},"epss":null,"cvss":null,"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1105"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104935#kev","url":"https://patchfirst.co/cve/CVE-2026-104935/","title":"[KEV] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","content_text":"Ivanti · Connect Secure. In CISA KEV since 2026-10-13. ENISA EUVD lists it as exploited. EPSS 86.8% (higher than 99.74% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.0 of 100.","summary":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-13T19:24:36.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79,"kev":{"dateAdded":"2026-10-13","ransomware":false},"epss":{"score":0.86766,"percentile":0.99742},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-109412","url":"https://patchfirst.co/cve/CVE-2026-109412/","title":"CVE-2026-109412: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak…","content_text":"Ivanti · Neurons Patch for Intune. Not in CISA KEV. EPSS 0.9% (higher than 58.8% of CVEs). CVSS 9.9 CRITICAL. Priority 20.8 of 100.","summary":"An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T19:17:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.8,"kev":null,"epss":{"score":0.0087,"percentile":0.58772},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Neurons Patch for Intune","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106042","url":"https://patchfirst.co/cve/CVE-2026-106042/","title":"CVE-2026-106042: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote…","content_text":"Ivanti · Xtraction. Not in CISA KEV. EPSS 0.8% (higher than 56.2% of CVEs). CVSS 9.9 CRITICAL. Priority 20.3 of 100.","summary":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T16:08:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.3,"kev":null,"epss":{"score":0.00789,"percentile":0.56194},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Xtraction","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-10520#kev","url":"https://patchfirst.co/cve/CVE-2026-10520/","title":"[KEV] CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability","content_text":"Ivanti · Sentry. In CISA KEV since 2026-06-11. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 75.0 of 100.","summary":"Ivanti Sentry OS Command Injection Vulnerability","date_published":"2026-06-11T00:00:00.000Z","date_modified":"2026-10-07T19:17:35.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":75,"kev":{"dateAdded":"2026-06-11","ransomware":false},"epss":{"score":0.99915,"percentile":0.99968},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Sentry","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-6973#kev","url":"https://patchfirst.co/cve/CVE-2026-6973/","title":"[KEV] CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2026-05-07. ENISA EUVD lists it as exploited. EPSS 34.5% (higher than 98.4% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 67.7 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability","date_published":"2026-05-07T00:00:00.000Z","date_modified":"2026-10-26T20:10:00.000Z","tags":["kev","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":67.7,"kev":{"dateAdded":"2026-05-07","ransomware":false},"epss":{"score":0.34454,"percentile":0.98412},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-1340#kev","url":"https://patchfirst.co/cve/CVE-2026-1340/","title":"[KEV] CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2026-04-08. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 84.8 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","date_published":"2026-04-08T00:00:00.000Z","date_modified":"2026-06-17T10:15:37.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-04-08","ransomware":false},"epss":{"score":0.98639,"percentile":0.99924},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-1603#kev","url":"https://patchfirst.co/cve/CVE-2026-1603/","title":"[KEV] CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","content_text":"Ivanti ·  Endpoint Manager (EPM). In CISA KEV since 2026-03-09. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 73.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability","date_published":"2026-03-09T00:00:00.000Z","date_modified":"2026-06-17T10:16:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2026-03-09","ransomware":false},"epss":{"score":0.88335,"percentile":0.99769},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":" Endpoint Manager (EPM)","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-1281#kev","url":"https://patchfirst.co/cve/CVE-2026-1281/","title":"[KEV] CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2026-01-29. ENISA EUVD lists it as exploited. EPSS 98.7% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 88.7 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","date_published":"2026-01-29T00:00:00.000Z","date_modified":"2026-06-17T10:15:26.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":88.7,"kev":{"dateAdded":"2026-01-29","ransomware":false},"epss":{"score":0.98688,"percentile":0.99925},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-4428#kev","url":"https://patchfirst.co/cve/CVE-2025-4428/","title":"[KEV] CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process. Priority 69.1 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T09:33:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1543"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.88003,"percentile":0.99764},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059","T1543"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-4427#kev","url":"https://patchfirst.co/cve/CVE-2025-4427/","title":"[KEV] CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 68.2 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T09:33:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.99927,"percentile":0.99969},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-22457#kev","url":"https://patchfirst.co/cve/CVE-2025-22457/","title":"[KEV] CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and ZTA Gateways. In CISA KEV since 2025-04-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","date_published":"2025-04-04T00:00:00.000Z","date_modified":"2026-08-04T05:16:33.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-04-04","ransomware":true},"epss":{"score":0.99981,"percentile":0.99981},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-13161#kev","url":"https://patchfirst.co/cve/CVE-2024-13161/","title":"[KEV] CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","content_text":"Ivanti · Endpoint Manager (EPM). In CISA KEV since 2025-03-10. ENISA EUVD lists it as exploited. EPSS 89.8% (higher than 99.79% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1558 Steal or Forge Kerberos Tickets; T1550.002 Pass the Hash; T1087 Account Discovery. Priority 68.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","date_published":"2025-03-10T00:00:00.000Z","date_modified":"2026-06-17T07:01:20.000Z","tags":["kev","public-exploit","T1190","T1558","T1550.002","T1087"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-10","ransomware":false},"epss":{"score":0.89809,"percentile":0.99789},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager (EPM)","techniqueIds":["T1190","T1558","T1550.002","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-13160#kev","url":"https://patchfirst.co/cve/CVE-2024-13160/","title":"[KEV] CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","content_text":"Ivanti · Endpoint Manager (EPM). In CISA KEV since 2025-03-10. ENISA EUVD lists it as exploited. EPSS 91.0% (higher than 99.81% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1558 Steal or Forge Kerberos Tickets; T1550.002 Pass the Hash; T1087 Account Discovery. Priority 68.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","date_published":"2025-03-10T00:00:00.000Z","date_modified":"2026-06-17T07:01:20.000Z","tags":["kev","public-exploit","T1190","T1558","T1550.002","T1087"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-10","ransomware":false},"epss":{"score":0.90985,"percentile":0.99807},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager (EPM)","techniqueIds":["T1190","T1558","T1550.002","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-13159#kev","url":"https://patchfirst.co/cve/CVE-2024-13159/","title":"[KEV] CVE-2024-13159: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","content_text":"Ivanti · Endpoint Manager (EPM). In CISA KEV since 2025-03-10. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1558 Steal or Forge Kerberos Tickets; T1550.002 Pass the Hash; T1087 Account Discovery. Priority 68.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability","date_published":"2025-03-10T00:00:00.000Z","date_modified":"2026-06-17T07:01:20.000Z","tags":["kev","public-exploit","T1190","T1558","T1550.002","T1087"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-10","ransomware":false},"epss":{"score":0.99993,"percentile":0.99986},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager (EPM)","techniqueIds":["T1190","T1558","T1550.002","T1087"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-13179","url":"https://patchfirst.co/cve/CVE-2024-13179/","title":"CVE-2024-13179: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 63.8% (higher than 99.22% of CVEs). CVSS 7.3 HIGH. Priority 25.0 of 100.","summary":"Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass…","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2025-01-16T16:53:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25,"kev":null,"epss":{"score":0.63819,"percentile":0.9922},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-13162","url":"https://patchfirst.co/cve/CVE-2024-13162/","title":"CVE-2024-13162: SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update…","content_text":"Ivanti · Endpoint Manager. Not in CISA KEV. EPSS 65.0% (higher than 99.25% of CVEs). CVSS 7.2 HIGH. Priority 24.9 of 100.","summary":"SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update…","date_published":"2025-01-14T00:00:00.000Z","date_modified":"2026-02-26T19:09:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.65013,"percentile":0.99249},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-0282#kev","url":"https://patchfirst.co/cve/CVE-2025-0282/","title":"[KEV] CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and ZTA Gateways. In CISA KEV since 2025-01-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1595 Active Scanning; T1003 OS Credential Dumping; T1055 Process Injection; T1018 Remote System Discovery; T1046 Network Service Discovery. Named in 2 threat reports. Priority 85.4 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","date_published":"2025-01-08T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","ransomware","public-exploit","T1190","T1595","T1003","T1055","T1018","T1046"],"_patchfirst":{"reason":"kev","priority":85.4,"kev":{"dateAdded":"2025-01-08","ransomware":true},"epss":{"score":0.99981,"percentile":0.99981},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","techniqueIds":["T1190","T1595","T1003","T1055","T1018","T1046"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-0283","url":"https://patchfirst.co/cve/CVE-2025-0283/","title":"CVE-2025-0283: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…","content_text":"Ivanti · Connect Secure. Not in CISA KEV. EPSS 17.5% (higher than 97.1% of CVEs). CVSS 7.0 HIGH. Named in 2 threat reports. Priority 78.5 of 100.","summary":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…","date_published":"2025-01-08T00:00:00.000Z","date_modified":"2026-02-26T19:09:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":78.5,"kev":null,"epss":{"score":0.17456,"percentile":0.97125},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":[],"reportCount":2,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-34781","url":"https://patchfirst.co/cve/CVE-2024-34781/","title":"CVE-2024-34781: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 68.5% (higher than 99.33% of CVEs). CVSS 7.2 HIGH. Priority 24.9 of 100.","summary":"SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…","date_published":"2024-11-13T00:00:00.000Z","date_modified":"2024-11-19T04:55:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.68461,"percentile":0.99334},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-37404","url":"https://patchfirst.co/cve/CVE-2024-37404/","title":"CVE-2024-37404: Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy…","content_text":"Ivanti · Connect Secure. Not in CISA KEV. EPSS 71.0% (higher than 99.4% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 31.3 of 100.","summary":"Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy…","date_published":"2024-10-18T00:00:00.000Z","date_modified":"2024-10-21T17:22:47.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.3,"kev":null,"epss":{"score":0.70955,"percentile":0.99401},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-9380#kev","url":"https://patchfirst.co/cve/CVE-2024-9380/","title":"[KEV] CVE-2024-9380: Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability","content_text":"Ivanti · Cloud Services Appliance (CSA). In CISA KEV since 2024-10-09. ENISA EUVD lists it as exploited. EPSS 58.3% (higher than 99.09% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 62.9 of 100.","summary":"Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability","date_published":"2024-10-09T00:00:00.000Z","date_modified":"2026-06-17T08:24:27.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2024-10-09","ransomware":false},"epss":{"score":0.58323,"percentile":0.99095},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-9379#kev","url":"https://patchfirst.co/cve/CVE-2024-9379/","title":"[KEV] CVE-2024-9379: Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability","content_text":"Ivanti · Cloud Services Appliance (CSA). In CISA KEV since 2024-10-09. ENISA EUVD lists it as exploited. EPSS 44.3% (higher than 98.8% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 62.8 of 100.","summary":"Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability","date_published":"2024-10-09T00:00:00.000Z","date_modified":"2026-10-01T19:17:15.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":62.8,"kev":{"dateAdded":"2024-10-09","ransomware":false},"epss":{"score":0.44268,"percentile":0.98757},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-9381","url":"https://patchfirst.co/cve/CVE-2024-9381/","title":"CVE-2024-9381: Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to…","content_text":"Ivanti · CSA (Cloud Services Appliance). Not in CISA KEV. EPSS 15.6% (higher than 96.8% of CVEs). CVSS 7.2 HIGH. Priority 62.2 of 100.","summary":"Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to…","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2024-10-08T19:23:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":62.2,"kev":null,"epss":{"score":0.15551,"percentile":0.96829},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"CSA (Cloud Services Appliance)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-47011","url":"https://patchfirst.co/cve/CVE-2024-47011/","title":"CVE-2024-47011: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 56.3% (higher than 99.05% of CVEs). CVSS 7.5 HIGH. Priority 25.1 of 100.","summary":"Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive…","date_published":"2024-10-08T00:00:00.000Z","date_modified":"2024-10-08T17:39:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.1,"kev":null,"epss":{"score":0.56345,"percentile":0.99053},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29824#kev","url":"https://patchfirst.co/cve/CVE-2024-29824/","title":"[KEV] CVE-2024-29824: Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability","content_text":"Ivanti · Endpoint Manager (EPM). In CISA KEV since 2024-10-02. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.2 of 100.","summary":"Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability","date_published":"2024-10-02T00:00:00.000Z","date_modified":"2026-06-17T07:23:11.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2024-10-02","ransomware":false},"epss":{"score":0.99938,"percentile":0.99972},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager (EPM)","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-7593#kev","url":"https://patchfirst.co/cve/CVE-2024-7593/","title":"[KEV] CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability","content_text":"Ivanti · Virtual Traffic Manager. In CISA KEV since 2024-09-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.9 of 100.","summary":"Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability","date_published":"2024-09-24T00:00:00.000Z","date_modified":"2026-06-17T08:20:30.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2024-09-24","ransomware":false},"epss":{"score":0.99999,"percentile":0.99991},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Virtual Traffic Manager","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-8963#kev","url":"https://patchfirst.co/cve/CVE-2024-8963/","title":"[KEV] CVE-2024-8963: Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability","content_text":"Ivanti · Cloud Services Appliance (CSA). In CISA KEV since 2024-09-19. ENISA EUVD lists it as exploited. EPSS 98.6% (higher than 99.92% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.4 of 100.","summary":"Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability","date_published":"2024-09-19T00:00:00.000Z","date_modified":"2026-06-17T08:23:38.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2024-09-19","ransomware":false},"epss":{"score":0.98607,"percentile":0.99923},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-8190#kev","url":"https://patchfirst.co/cve/CVE-2024-8190/","title":"[KEV] CVE-2024-8190: Ivanti Cloud Services Appliance OS Command Injection Vulnerability","content_text":"Ivanti · Cloud Services Appliance. In CISA KEV since 2024-09-13. ENISA EUVD lists it as exploited. EPSS 88.5% (higher than 99.77% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 68.0 of 100.","summary":"Ivanti Cloud Services Appliance OS Command Injection Vulnerability","date_published":"2024-09-13T00:00:00.000Z","date_modified":"2026-06-17T08:22:05.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2024-09-13","ransomware":false},"epss":{"score":0.88535,"percentile":0.99772},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Cloud Services Appliance","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-37397","url":"https://patchfirst.co/cve/CVE-2024-37397/","title":"CVE-2024-37397: An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 59.3% (higher than 99.12% of CVEs). CVSS 8.2 HIGH. Priority 25.6 of 100.","summary":"An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024…","date_published":"2024-09-12T00:00:00.000Z","date_modified":"2024-09-13T15:48:43.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.6,"kev":null,"epss":{"score":0.59257,"percentile":0.99116},"cvss":{"score":8.2,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-38653","url":"https://patchfirst.co/cve/CVE-2024-38653/","title":"CVE-2024-38653: XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 92.0% (higher than 99.82% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. Priority 65.7 of 100.","summary":"XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on…","date_published":"2024-08-14T00:00:00.000Z","date_modified":"2024-08-14T13:47:52.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.7,"kev":null,"epss":{"score":0.91984,"percentile":0.99819},"cvss":{"score":8.2,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-29826","url":"https://patchfirst.co/cve/CVE-2024-29826/","title":"CVE-2024-29826: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.6 CRITICAL. Priority 26.7 of 100.","summary":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-08-02T01:17:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.7,"kev":null,"epss":{"score":0.99877,"percentile":0.99965},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29825","url":"https://patchfirst.co/cve/CVE-2024-29825/","title":"CVE-2024-29825: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.6 CRITICAL. Priority 26.7 of 100.","summary":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-08-02T01:17:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.7,"kev":null,"epss":{"score":0.99877,"percentile":0.99964},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29823","url":"https://patchfirst.co/cve/CVE-2024-29823/","title":"CVE-2024-29823: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.6 CRITICAL. Priority 26.7 of 100.","summary":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-08-02T01:17:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.7,"kev":null,"epss":{"score":0.9986,"percentile":0.99962},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29827","url":"https://patchfirst.co/cve/CVE-2024-29827/","title":"CVE-2024-29827: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 71.7% (higher than 99.42% of CVEs). CVSS 9.6 CRITICAL. Priority 26.6 of 100.","summary":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-08-02T01:17:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.6,"kev":null,"epss":{"score":0.71685,"percentile":0.9942},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29822","url":"https://patchfirst.co/cve/CVE-2024-29822/","title":"CVE-2024-29822: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","content_text":"Ivanti · EPM. Not in CISA KEV. EPSS 64.4% (higher than 99.23% of CVEs). CVSS 9.6 CRITICAL. Priority 26.6 of 100.","summary":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-08-02T01:17:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.6,"kev":null,"epss":{"score":0.6439,"percentile":0.99234},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"EPM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-29848","url":"https://patchfirst.co/cve/CVE-2024-29848/","title":"CVE-2024-29848: An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 64.4% (higher than 99.23% of CVEs). CVSS 7.2 HIGH. Priority 24.9 of 100.","summary":"An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated…","date_published":"2024-05-31T00:00:00.000Z","date_modified":"2024-09-19T05:08:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.64423,"percentile":0.99234},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-24994","url":"https://patchfirst.co/cve/CVE-2024-24994/","title":"CVE-2024-24994: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 68.1% (higher than 99.33% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.","summary":"A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","date_published":"2024-04-19T00:00:00.000Z","date_modified":"2024-08-01T23:36:21.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.68104,"percentile":0.99326},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-24992","url":"https://patchfirst.co/cve/CVE-2024-24992/","title":"CVE-2024-24992: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 70.9% (higher than 99.4% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.","summary":"A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","date_published":"2024-04-19T00:00:00.000Z","date_modified":"2025-01-07T00:40:56.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.70908,"percentile":0.994},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-23535","url":"https://patchfirst.co/cve/CVE-2024-23535/","title":"CVE-2024-23535: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","content_text":"Ivanti · Avalanche. Not in CISA KEV. EPSS 68.1% (higher than 99.33% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.","summary":"A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…","date_published":"2024-04-19T00:00:00.000Z","date_modified":"2025-12-16T18:13:20.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.68104,"percentile":0.99326},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Avalanche","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-21894","url":"https://patchfirst.co/cve/CVE-2024-21894/","title":"CVE-2024-21894: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows…","content_text":"Ivanti · Connect Secure. Not in CISA KEV. EPSS 19.0% (higher than 97.3% of CVEs). CVSS 8.2 HIGH. Priority 62.5 of 100.","summary":"A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows…","date_published":"2024-04-04T00:00:00.000Z","date_modified":"2024-10-03T21:43:40.000Z","tags":[],"_patchfirst":{"reason":"published","priority":62.5,"kev":null,"epss":{"score":0.18987,"percentile":0.973},"cvss":{"score":8.2,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"Connect Secure","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-41724","url":"https://patchfirst.co/cve/CVE-2023-41724/","title":"CVE-2023-41724: A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute…","content_text":"Ivanti · Sentry. Not in CISA KEV. EPSS 12.8% (higher than 96.3% of CVEs). CVSS 9.6 CRITICAL. Priority 61.0 of 100.","summary":"A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute…","date_published":"2024-03-31T00:00:00.000Z","date_modified":"2025-03-25T14:36:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":61,"kev":null,"epss":{"score":0.12844,"percentile":0.9629},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"Sentry","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-46808","url":"https://patchfirst.co/cve/CVE-2023-46808/","title":"CVE-2023-46808: An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes…","content_text":"Ivanti · ITSM. Not in CISA KEV. EPSS 2.0% (higher than 80.7% of CVEs). CVSS 9.9 CRITICAL. Priority 58.1 of 100.","summary":"An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes…","date_published":"2024-03-31T00:00:00.000Z","date_modified":"2024-08-02T20:53:21.000Z","tags":[],"_patchfirst":{"reason":"published","priority":58.1,"kev":null,"epss":{"score":0.02001,"percentile":0.8074},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0"},"vendor":"Ivanti","product":"ITSM","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-44529#kev","url":"https://patchfirst.co/cve/CVE-2021-44529/","title":"[KEV] CVE-2021-44529: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA). In CISA KEV since 2024-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.1% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain. Priority 79.8 of 100.","summary":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","date_published":"2024-03-25T00:00:00.000Z","date_modified":"2026-08-04T05:16:27.000Z","tags":["kev","ransomware","public-exploit","T1190","T1195.002"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-03-25","ransomware":true},"epss":{"score":0.99105,"percentile":0.99933},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","techniqueIds":["T1190","T1195.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-22024","url":"https://patchfirst.co/cve/CVE-2024-22024/","title":"CVE-2024-22024: An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…","content_text":"Ivanti · ICS. Not in CISA KEV. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 8.3 HIGH. Public exploit code exists. Priority 68.1 of 100.","summary":"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…","date_published":"2024-02-13T00:00:00.000Z","date_modified":"2025-05-09T18:26:09.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":68.1,"kev":null,"epss":{"score":0.94721,"percentile":0.99857},"cvss":{"score":8.3,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"ICS","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-21893#kev","url":"https://patchfirst.co/cve/CVE-2024-21893/","title":"[KEV] CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and Neurons. In CISA KEV since 2024-01-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Priority 78.7 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2024-01-31T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078","T1505.003","T1555"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2024-01-31","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons","techniqueIds":["T1190","T1078","T1505.003","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21888","url":"https://patchfirst.co/cve/CVE-2024-21888/","title":"CVE-2024-21888: A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure…","content_text":"Ivanti · ICS. Not in CISA KEV. EPSS 85.4% (higher than 99.72% of CVEs). CVSS 8.8 HIGH. Priority 64.1 of 100.","summary":"A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure…","date_published":"2024-01-31T00:00:00.000Z","date_modified":"2025-12-16T18:13:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":64.1,"kev":null,"epss":{"score":0.85418,"percentile":0.99719},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0"},"vendor":"Ivanti","product":"ICS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-35082#kev","url":"https://patchfirst.co/cve/CVE-2023-35082/","title":"[KEV] CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron Core. In CISA KEV since 2024-01-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.9 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability","date_published":"2024-01-18T00:00:00.000Z","date_modified":"2026-06-17T06:04:23.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-01-18","ransomware":true},"epss":{"score":0.99999,"percentile":0.99995},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM) and MobileIron Core","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21887","url":"https://patchfirst.co/cve/CVE-2024-21887/","title":"CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","content_text":"Ivanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1552 Unsecured Credentials. Named in 4 threat reports. Priority 88.4 of 100.","summary":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","date_published":"2024-01-12T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003","T1552"],"_patchfirst":{"reason":"published","priority":88.4,"kev":{"dateAdded":"2024-01-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure and Policy Secure","techniqueIds":["T1190","T1059","T1505.003","T1552"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}}]}