Ivanti: CISA KEV History
Every Ivanti vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.
Snapshot: 2026-09-08 · Source: CISA KEV Catalog · Full KEV dashboard
KEV entries
35
Added, last 12 months
5
Ransomware-linked
12
Latest addition
2026-06-11
Ivanti KEV additions per month, last 24 months
Most-listed products: Endpoint Manager Mobile (EPMM), Pulse Connect Secure, Endpoint Manager (EPM), Cloud Services Appliance (CSA), Sentry.
Latest 35 of 35 Ivanti KEV entries
| CVE | Vulnerability | Added | Ransomware |
|---|---|---|---|
| CVE-2026-10520 | Ivanti Sentry OS Command Injection Vulnerability | 2026-06-11 | No |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | 2026-05-07 | No |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2026-04-08 | No |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | 2026-03-09 | No |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2026-01-29 | No |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2025-05-19 | No |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | 2025-05-19 | No |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnera | 2025-04-04 | Yes |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-10 | No |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-10 | No |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | 2025-03-10 | No |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnera | 2025-01-08 | Yes |
| CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | 2024-10-09 | No |
| CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | 2024-10-09 | No |
| CVE-2024-29824 | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | 2024-10-02 | No |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | 2024-09-24 | No |
| CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | 2024-09-19 | No |
| CVE-2024-8190 | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | 2024-09-13 | No |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | 2024-03-25 | Yes |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulne | 2024-01-31 | Yes |
| CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerabil | 2024-01-18 | Yes |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | 2024-01-10 | Yes |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | 2024-01-10 | Yes |
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | 2023-08-22 | Yes |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | 2023-07-31 | No |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | 2023-07-25 | Yes |
| CVE-2020-15505 | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | 2021-11-03 | No |
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | 2021-11-03 | Yes |
| CVE-2020-8243 | Ivanti Pulse Connect Secure Code Execution Vulnerability | 2021-11-03 | No |
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | 2021-11-03 | No |
| CVE-2021-22894 | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | 2021-11-03 | No |
| CVE-2020-8260 | Ivanti Pulse Connect Secure Code Execution Vulnerability | 2021-11-03 | No |
| CVE-2021-22899 | Ivanti Pulse Connect Secure Command Injection Vulnerability | 2021-11-03 | No |
| CVE-2019-11510 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | 2021-11-03 | Yes |
| CVE-2019-11539 | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | 2021-11-03 | Yes |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.