[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZqA1qTUto0_GoiZLxPvCwT-OIG30AZalc4ICoayoHD8":3,"g5a-family:ivanti\u002Fpolicy_secure":165,"g5a-ex:ivanti\u002Fpolicy_secure@*":166},{"success":4,"data":5},true,{"product":6,"versions":40,"topVulnerabilitiesByEpss":50,"kevVulnerabilities":107,"seoMetadata":143,"meta":162},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":39},"ivanti","policy_secure",9,60,8,"2025-09-09",[14,18,20,22,24,26,28,32,35],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},"22.1",10,3,{"version":19,"cve_count":16,"kev_count":17,"has_kev":4},"22.2",{"version":21,"cve_count":11,"kev_count":17,"has_kev":4},"22.3",{"version":23,"cve_count":11,"kev_count":17,"has_kev":4},"22.4",{"version":25,"cve_count":9,"kev_count":17,"has_kev":4},"22.5",{"version":27,"cve_count":11,"kev_count":17,"has_kev":4},"22.6",{"version":29,"cve_count":30,"kev_count":31,"has_kev":4},"22.7",32,2,{"version":33,"cve_count":16,"kev_count":34,"has_kev":4},"9.0",4,{"version":36,"cve_count":37,"kev_count":38,"has_kev":4},"9.1",25,5,"Policy Secure by Ivanti is a technology product with 9 tracked versions and 60 known security vulnerabilities including 8 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[41,42,43,44,45,46,47,48,49],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},{"version":19,"cve_count":16,"kev_count":17,"has_kev":4},{"version":21,"cve_count":11,"kev_count":17,"has_kev":4},{"version":23,"cve_count":11,"kev_count":17,"has_kev":4},{"version":25,"cve_count":9,"kev_count":17,"has_kev":4},{"version":27,"cve_count":11,"kev_count":17,"has_kev":4},{"version":29,"cve_count":30,"kev_count":31,"has_kev":4},{"version":33,"cve_count":16,"kev_count":34,"has_kev":4},{"version":36,"cve_count":37,"kev_count":38,"has_kev":4},[51,59,65,69,74,79,85,92,97,102],{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"cvssVersion":56,"severity":57,"isKev":4,"epssScore":58},"CVE-2024-21893","A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.","2024-01-31",8.2,"v3.1","High",0.99999,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"cvssVersion":56,"severity":64,"isKev":4,"epssScore":58},"CVE-2024-21887","A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","2024-01-12",9.1,"Critical",{"cveId":66,"description":67,"publishedDate":62,"cvssScore":55,"cvssVersion":56,"severity":57,"isKev":4,"epssScore":68},"CVE-2023-46805","An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.",0.99986,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":9,"cvssVersion":56,"severity":64,"isKev":4,"epssScore":73},"CVE-2025-22457","A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","2025-04-03",0.99979,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":9,"cvssVersion":56,"severity":64,"isKev":4,"epssScore":78},"CVE-2025-0282","A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","2025-01-08",0.99971,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":56,"severity":57,"isKev":4,"epssScore":84},"CVE-2019-11539","In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.","2019-04-26",7.2,0.98617,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":56,"severity":57,"isKev":90,"epssScore":91},"CVE-2024-22024","An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.","2024-02-13",8.3,false,0.94721,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":83,"cvssVersion":56,"severity":57,"isKev":4,"epssScore":96},"CVE-2020-8243","A vulnerability in the Pulse Connect Secure \u003C 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.","2020-09-30",0.90759,{"cveId":98,"description":99,"publishedDate":54,"cvssScore":100,"cvssVersion":56,"severity":57,"isKev":90,"epssScore":101},"CVE-2024-21888","A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. ",8.8,0.86806,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":100,"cvssVersion":56,"severity":57,"isKev":90,"epssScore":106},"CVE-2024-37404","Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.","2024-10-18",0.67291,[108,113,116,120,124,127,136,140],{"cveId":70,"description":71,"publishedDate":72,"cvssScore":9,"severity":64,"isKev":4,"epssScore":73,"cisaVulnName":109,"cisaDateAdded":110,"cisaShortDescription":111,"cisaRequiredAction":112},"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","2025-04-04","Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. ","Apply mitigations as set forth in the CISA instructions linked below.",{"cveId":75,"description":76,"publishedDate":77,"cvssScore":9,"severity":64,"isKev":4,"epssScore":78,"cisaVulnName":109,"cisaDateAdded":77,"cisaShortDescription":114,"cisaRequiredAction":115},"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.","Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.",{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"severity":57,"isKev":4,"epssScore":58,"cisaVulnName":117,"cisaDateAdded":54,"cisaShortDescription":118,"cisaRequiredAction":119},"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"severity":64,"isKev":4,"epssScore":58,"cisaVulnName":121,"cisaDateAdded":122,"cisaShortDescription":123,"cisaRequiredAction":119},"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","2024-01-10","Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.",{"cveId":66,"description":67,"publishedDate":62,"cvssScore":55,"severity":57,"isKev":4,"epssScore":68,"cisaVulnName":125,"cisaDateAdded":122,"cisaShortDescription":126,"cisaRequiredAction":119},"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.",{"cveId":128,"description":129,"publishedDate":130,"cvssScore":83,"severity":57,"isKev":4,"epssScore":131,"cisaVulnName":132,"cisaDateAdded":133,"cisaShortDescription":134,"cisaRequiredAction":135},"CVE-2020-8218","A code injection vulnerability exists in Pulse Connect Secure \u003C9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.","2020-07-30",0.32739,"Pulse Connect Secure Code Injection Vulnerability","2022-03-07","A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.","Apply updates per vendor instructions.",{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"severity":57,"isKev":4,"epssScore":84,"cisaVulnName":137,"cisaDateAdded":138,"cisaShortDescription":139,"cisaRequiredAction":135},"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","2021-11-03","Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.",{"cveId":93,"description":94,"publishedDate":95,"cvssScore":83,"severity":57,"isKev":4,"epssScore":96,"cisaVulnName":141,"cisaDateAdded":138,"cisaShortDescription":142,"cisaRequiredAction":135},"Ivanti Pulse Connect Secure Code Execution Vulnerability","Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.",{"title":144,"metaDescription":145,"keywords":146,"structuredData":147},"Policy Secure by Ivanti - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Policy Secure by Ivanti covering 9 versions with 60 tracked vulnerabilities including 3 critical and 5 high-severity issues and 8 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Policy Secure vulnerabilities, Policy Secure security, Policy Secure CVE, Ivanti Policy Secure, Policy Secure threat intelligence, Ivanti security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Policy Secure KEV, Policy Secure exploited vulnerabilities",{"@context":148,"@type":149,"name":150,"description":145,"url":151,"manufacturer":152,"applicationCategory":156,"softwareVersion":157,"mainEntity":158},"https:\u002F\u002Fschema.org","SoftwareApplication","Policy Secure","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fivanti\u002Fpolicy_secure",{"@type":153,"name":154,"url":155},"Organization","Ivanti","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fivanti","Security Software","9 versions tracked",{"@type":159,"name":160,"description":161,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Policy Secure Security Vulnerabilities","Security vulnerabilities affecting Policy Secure by Ivanti",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":163,"apiVersion":164},"2026-10-28T18:36:23.324Z","3.0",[],{"rows":167,"total":11,"capped":90,"failed":251},[168,177,181,229,234,238,242,246],{"cveId":70,"name":109,"severity":64,"cvss":9,"added":110,"epss":73,"published":169,"ranges":170,"checked":4,"hits":176,"covers":90},"2025-04-03T16:15:35.37",[171,29,172,173,174,175],"before 22.7","22.7-r1","22.7-r1.1","22.7-r1.2","22.7-r1.3",[],{"cveId":75,"name":109,"severity":64,"cvss":9,"added":77,"epss":78,"published":178,"ranges":179,"checked":4,"hits":180,"covers":90},"2025-01-08T23:15:09.763",[172,173,174],[],{"cveId":52,"name":117,"severity":57,"cvss":55,"added":54,"epss":58,"published":182,"ranges":183,"checked":4,"hits":228,"covers":90},"2024-01-31T18:15:47.437",[33,184,185,186,187,188,189,36,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227],"9.0-r1","9.0-r2","9.0-r2.1","9.0-r3","9.0-r3.1","9.0-r4","9.1-r1","9.1-r2","9.1-r3","9.1-r3.1","9.1-r4","9.1-r4.1","9.1-r4.2","9.1-r4.3","9.1-r5","9.1-r6","9.1-r7","9.1-r8","9.1-r8.1","9.1-r8.2","9.1-r9","9.1-r10","9.1-r11","9.1-r12","9.1-r13","9.1-r13.1","9.1-r14","9.1-r15","9.1-r16","9.1-r17","9.1-r18","9.1-r18.1","9.1-r18.2","22.1-r1","22.1-r6","22.2-r1","22.2-r3","22.3-r1","22.3-r3","22.4-r1","22.4-r2","22.4-r2.1","22.5-r1","22.6-r1",[],{"cveId":60,"name":121,"severity":64,"cvss":63,"added":122,"epss":58,"published":230,"ranges":231,"checked":4,"hits":233,"covers":90},"2024-01-12T17:15:10.017",[33,190,191,192,193,194,195,196,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,217,218,219,220,221,222,223,224,225,226,232,227],"22.5-r2.1",[],{"cveId":66,"name":125,"severity":57,"cvss":55,"added":122,"epss":68,"published":235,"ranges":236,"checked":4,"hits":237,"covers":90},"2024-01-12T17:15:09.53",[33,190,191,192,193,194,195,196,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,217,218,219,220,221,222,223,224,225,226,232,227],[],{"cveId":128,"name":132,"severity":57,"cvss":83,"added":133,"epss":131,"published":239,"ranges":240,"checked":4,"hits":241,"covers":90},"2020-07-30T13:15:11.847",[36,190,191,192,193,194,195,196,198,199,200],[],{"cveId":80,"name":137,"severity":57,"cvss":83,"added":138,"epss":84,"published":243,"ranges":244,"checked":4,"hits":245,"covers":90},"2019-04-26T02:29:00.3",[184,185,186,187,188],[],{"cveId":93,"name":141,"severity":57,"cvss":83,"added":138,"epss":96,"published":247,"ranges":248,"checked":4,"hits":250,"covers":90},"2020-09-30T18:15:29.07",[249,36,190,191,192,194,195,196,197,198,199,200,201,202],"up to 9.0",[],0]