Ivanti
- Exploited flaws
- 36in 16 products
- Added to CISA's list in 2026
- 67 in 2025
- Used by ransomware
- 12of 36, says CISA
- Disclosure to CISA's list
- 2 daysmedian; 16 of 24 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2019 | 2 |
| 2020 | 3 |
| 2021 | 5 |
| 2022 | 0 |
| 2023 | 5 |
| 2024 | 11 |
| 2025 | 4 |
| 2026 | 6 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Endpoint Manager Mobile (EPMM) | 7 | 2023-07-25 | 2026-05-07 |
| Pulse Connect Secure | 7 | 2021-11-03 | 2021-11-03 |
| Endpoint Manager (EPM) | 4 | 2024-10-02 | 2025-03-10 |
| Cloud Services Appliance (CSA) | 3 | 2024-09-19 | 2024-10-09 |
| Connect Secure and Policy Secure | 2 | 2024-01-10 | 2024-01-10 |
| Connect Secure, Policy Secure, and ZTA Gateways | 2 | 2025-01-08 | 2025-04-04 |
| Sentry | 2 | 2023-08-22 | 2026-06-11 |
Latest on CISA's list
- Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- Ivanti Sentry OS Command Injection Vulnerability
- Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
- Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
- Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
- Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
In the news
No security story in the last 14 days named Ivanti in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.