# Ivanti vulnerabilities

> Ivanti has 404 published vulnerabilities across 35 products in our catalogue. 30 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Avalanche, with 116. If you run Ivanti software, patch the exploited flaws first.

Canonical page: https://www.edgeprotect.io/vendors/ivanti

## At a glance

- **Published vulnerabilities:** 404
- **Known to be exploited:** 30
- **Products:** 35
- **Versions:** 332
- **Most recently added to the known-exploited list:** [CVE-2025-4428](https://www.edgeprotect.io/what-is/cve-2025-4428), 19 May 2025. We keep watching the list.

## Which Ivanti products have the most vulnerabilities?

- [Avalanche](https://www.edgeprotect.io/product/ivanti/avalanche): 116 published vulnerabilities, 32 versions
- [Connect Secure](https://www.edgeprotect.io/product/ivanti/connect_secure): 111 published vulnerabilities, 18 versions
- [Endpoint Manager](https://www.edgeprotect.io/product/ivanti/endpoint_manager): 86 published vulnerabilities, 13 versions
- [Policy Secure](https://www.edgeprotect.io/product/ivanti/policy_secure): 60 published vulnerabilities, 9 versions
- [Workspace Control](https://www.edgeprotect.io/product/ivanti/workspace_control): 19 published vulnerabilities, 26 versions
- [Endpoint Manager Mobile](https://www.edgeprotect.io/product/ivanti/endpoint_manager_mobile): 19 published vulnerabilities, 70 versions
- [Zero Trust Access Gateway](https://www.edgeprotect.io/product/ivanti/zero_trust_access_gateway): 17 published vulnerabilities, 4 versions
- [Neurons for Secure Access](https://www.edgeprotect.io/product/ivanti/neurons_for_secure_access): 15 published vulnerabilities, 10 versions
- [Secure Access Client](https://www.edgeprotect.io/product/ivanti/secure_access_client): 14 published vulnerabilities, 6 versions
- [Landesk Management Suite](https://www.edgeprotect.io/product/ivanti/landesk_management_suite): 6 published vulnerabilities, 3 versions

Each product page lists its own known-exploited flaws.

## Which Ivanti vulnerabilities are being exploited?

30 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2025-4428](https://www.edgeprotect.io/what-is/cve-2025-4428): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability. High, CVSS 7.2, chance of use in 30 days 84%, known exploited since 19 May 2025.
- [CVE-2025-4427](https://www.edgeprotect.io/what-is/cve-2025-4427): Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability. Medium, CVSS 5.3, chance of use in 30 days >99%, known exploited since 19 May 2025.
- [CVE-2025-22457](https://www.edgeprotect.io/what-is/cve-2025-22457): Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability. Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 4 April 2025.
- [CVE-2024-13159](https://www.edgeprotect.io/what-is/cve-2024-13159): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 10 March 2025.
- [CVE-2024-13160](https://www.edgeprotect.io/what-is/cve-2024-13160): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 90%, known exploited since 10 March 2025.
- [CVE-2024-13161](https://www.edgeprotect.io/what-is/cve-2024-13161): Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 89%, known exploited since 10 March 2025.
- [CVE-2025-0282](https://www.edgeprotect.io/what-is/cve-2025-0282): Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability. Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 8 January 2025.
- [CVE-2024-9380](https://www.edgeprotect.io/what-is/cve-2024-9380): Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability. High, CVSS 7.2, chance of use in 30 days 63%, known exploited since 9 October 2024.
- [CVE-2024-9379](https://www.edgeprotect.io/what-is/cve-2024-9379): Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 44%, known exploited since 9 October 2024.
- [CVE-2024-29824](https://www.edgeprotect.io/what-is/cve-2024-29824): Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability. High, CVSS 8.8, chance of use in 30 days >99%, known exploited since 2 October 2024.
- [CVE-2024-7593](https://www.edgeprotect.io/what-is/cve-2024-7593): Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 24 September 2024.
- [CVE-2024-8963](https://www.edgeprotect.io/what-is/cve-2024-8963): Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability. Critical, CVSS 9.4, chance of use in 30 days 99%, known exploited since 19 September 2024.
- [CVE-2024-8190](https://www.edgeprotect.io/what-is/cve-2024-8190): Ivanti Cloud Services Appliance OS Command Injection Vulnerability. High, CVSS 7.2, chance of use in 30 days 89%, known exploited since 13 September 2024.
- [CVE-2021-44529](https://www.edgeprotect.io/what-is/cve-2021-44529): Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 March 2024.
- [CVE-2024-21893](https://www.edgeprotect.io/what-is/cve-2024-21893): Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability. High, CVSS 8.2, chance of use in 30 days >99%, known exploited since 31 January 2024.
- [CVE-2023-35082](https://www.edgeprotect.io/what-is/cve-2023-35082): Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 18 January 2024.
- [CVE-2024-21887](https://www.edgeprotect.io/what-is/cve-2024-21887): Ivanti Connect Secure and Policy Secure Command Injection Vulnerability. Critical, CVSS 9.1, chance of use in 30 days >99%, known exploited since 10 January 2024.
- [CVE-2023-46805](https://www.edgeprotect.io/what-is/cve-2023-46805): Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability. High, CVSS 8.2, chance of use in 30 days >99%, known exploited since 10 January 2024.
- [CVE-2023-38035](https://www.edgeprotect.io/what-is/cve-2023-38035): Ivanti Sentry Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 22 August 2023.
- [CVE-2023-35081](https://www.edgeprotect.io/what-is/cve-2023-35081): Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability. High, CVSS 7.2, chance of use in 30 days 63%, known exploited since 31 July 2023.
- [CVE-2023-35078](https://www.edgeprotect.io/what-is/cve-2023-35078): Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 July 2023.
- [CVE-2020-8218](https://www.edgeprotect.io/what-is/cve-2020-8218): Pulse Connect Secure Code Injection Vulnerability. High, CVSS 7.2, chance of use in 30 days 33%, known exploited since 7 March 2022.
- [CVE-2021-22893](https://www.edgeprotect.io/what-is/cve-2021-22893): Ivanti Pulse Connect Secure Use-After-Free Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 47%, known exploited since 3 November 2021.
- [CVE-2019-11510](https://www.edgeprotect.io/what-is/cve-2019-11510): Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability. Critical, CVSS 10.0, chance of use in 30 days >99%, known exploited since 3 November 2021.
- [CVE-2021-22899](https://www.edgeprotect.io/what-is/cve-2021-22899): Ivanti Pulse Connect Secure Command Injection Vulnerability. High, CVSS 8.8, chance of use in 30 days 22%, known exploited since 3 November 2021.
- [CVE-2021-22894](https://www.edgeprotect.io/what-is/cve-2021-22894): Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 41%, known exploited since 3 November 2021.
- [CVE-2019-11539](https://www.edgeprotect.io/what-is/cve-2019-11539): Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability. High, CVSS 7.2, chance of use in 30 days 99%, known exploited since 3 November 2021.
- [CVE-2021-22900](https://www.edgeprotect.io/what-is/cve-2021-22900): Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability. High, CVSS 7.2, chance of use in 30 days 14%, known exploited since 3 November 2021.
- [CVE-2020-8243](https://www.edgeprotect.io/what-is/cve-2020-8243): Ivanti Pulse Connect Secure Code Execution Vulnerability. High, CVSS 7.2, chance of use in 30 days 91%, known exploited since 3 November 2021.
- [CVE-2020-8260](https://www.edgeprotect.io/what-is/cve-2020-8260): Ivanti Pulse Connect Secure Code Execution Vulnerability. High, CVSS 7.2, chance of use in 30 days 96%, known exploited since 3 November 2021.

## Which Ivanti flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2019-11510](https://www.edgeprotect.io/what-is/cve-2019-11510): >99%, Critical (CVSS 10.0), known exploited
- [CVE-2024-21893](https://www.edgeprotect.io/what-is/cve-2024-21893): >99%, High (CVSS 8.2), known exploited
- [CVE-2023-35082](https://www.edgeprotect.io/what-is/cve-2023-35082): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2023-35078](https://www.edgeprotect.io/what-is/cve-2023-35078): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2024-21887](https://www.edgeprotect.io/what-is/cve-2024-21887): >99%, Critical (CVSS 9.1), known exploited
- [CVE-2024-7593](https://www.edgeprotect.io/what-is/cve-2024-7593): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2023-46805](https://www.edgeprotect.io/what-is/cve-2023-46805): >99%, High (CVSS 8.2), known exploited
- [CVE-2025-22457](https://www.edgeprotect.io/what-is/cve-2025-22457): >99%, Critical (CVSS 9.0), known exploited
- [CVE-2025-0282](https://www.edgeprotect.io/what-is/cve-2025-0282): >99%, Critical (CVSS 9.0), known exploited
- [CVE-2024-29824](https://www.edgeprotect.io/what-is/cve-2024-29824): >99%, High (CVSS 8.8), known exploited

## All Ivanti products we track

34 products with at least one tracked version, most vulnerabilities first:

- [Avalanche](https://www.edgeprotect.io/product/ivanti/avalanche): 116 vulnerabilities, 32 versions
- [Connect Secure](https://www.edgeprotect.io/product/ivanti/connect_secure): 111 vulnerabilities, 18 versions
- [Endpoint Manager](https://www.edgeprotect.io/product/ivanti/endpoint_manager): 86 vulnerabilities, 13 versions
- [Policy Secure](https://www.edgeprotect.io/product/ivanti/policy_secure): 60 vulnerabilities, 9 versions
- [Workspace Control](https://www.edgeprotect.io/product/ivanti/workspace_control): 19 vulnerabilities, 26 versions
- [Endpoint Manager Mobile](https://www.edgeprotect.io/product/ivanti/endpoint_manager_mobile): 19 vulnerabilities, 70 versions
- [Zero Trust Access Gateway](https://www.edgeprotect.io/product/ivanti/zero_trust_access_gateway): 17 vulnerabilities, 4 versions
- [Neurons for Secure Access](https://www.edgeprotect.io/product/ivanti/neurons_for_secure_access): 15 vulnerabilities, 10 versions
- [Secure Access Client](https://www.edgeprotect.io/product/ivanti/secure_access_client): 14 vulnerabilities, 6 versions
- [Landesk Management Suite](https://www.edgeprotect.io/product/ivanti/landesk_management_suite): 6 vulnerabilities, 3 versions
- [Neurons for Zero-Trust Access](https://www.edgeprotect.io/product/ivanti/neurons_for_zero-trust_access): 6 vulnerabilities, 7 versions
- [Endpoint Manager Cloud Services Appliance](https://www.edgeprotect.io/product/ivanti/endpoint_manager_cloud_services_appliance): 5 vulnerabilities, 2 versions
- [Cloud Services Appliance](https://www.edgeprotect.io/product/ivanti/cloud_services_appliance): 5 vulnerabilities, 5 versions
- [Neurons for Itsm](https://www.edgeprotect.io/product/ivanti/neurons_for_itsm): 3 vulnerabilities, 9 versions
- [Incapptic Connect](https://www.edgeprotect.io/product/ivanti/incapptic_connect): 3 vulnerabilities, 14 versions
- [Mobileiron](https://www.edgeprotect.io/product/ivanti/mobileiron): 2 vulnerabilities, 3 versions
- [Automation](https://www.edgeprotect.io/product/ivanti/automation): 2 vulnerabilities, 25 versions
- [Application Control](https://www.edgeprotect.io/product/ivanti/application_control): 1 vulnerability, 3 versions
- Desktop&server Management: 1 vulnerability, 2 versions
- Desktop & Server Management: 1 vulnerability, 7 versions
- Docs@work: 1 vulnerability, 11 versions
- [Dsm Netinst](https://www.edgeprotect.io/product/ivanti/dsm_netinst): 1 vulnerability, 1 version
- [Endpoint Security](https://www.edgeprotect.io/product/ivanti/endpoint_security): 1 vulnerability, 1 version
- [Mobileiron Sentry](https://www.edgeprotect.io/product/ivanti/mobileiron_sentry): 1 vulnerability, 1 version
- [Performance Manager](https://www.edgeprotect.io/product/ivanti/performance_manager): 1 vulnerability, 3 versions
- [Pulse Secure Desktop Client](https://www.edgeprotect.io/product/ivanti/pulse_secure_desktop_client): 1 vulnerability, 1 version
- [Pulse Secure Installer Service](https://www.edgeprotect.io/product/ivanti/pulse_secure_installer_service): 1 vulnerability, 2 versions
- [Security Controls](https://www.edgeprotect.io/product/ivanti/security_controls): 1 vulnerability, 15 versions
- [Service Manager](https://www.edgeprotect.io/product/ivanti/service_manager): 1 vulnerability, 1 version
- [Service Manager Heat Remote Control](https://www.edgeprotect.io/product/ivanti/service_manager_heat_remote_control): 1 vulnerability, 1 version
- [Standalone Sentry](https://www.edgeprotect.io/product/ivanti/standalone_sentry): 1 vulnerability, 20 versions
- [Virtual Traffic Management](https://www.edgeprotect.io/product/ivanti/virtual_traffic_management): 1 vulnerability, 5 versions
- [Zero Trust Access](https://www.edgeprotect.io/product/ivanti/zero_trust_access): 1 vulnerability, 1 version
- Mobileiron Mobile@work: 0 vulnerabilities, 1 version

## Questions

### How many vulnerabilities does Ivanti have?

Our catalogue lists 404 published vulnerabilities across 35 products and 332 versions from Ivanti. The most recent Ivanti flaw added to the known-exploited list is CVE-2025-4428, on 19 May 2025.

### Which Ivanti vulnerabilities are being exploited?

30 Ivanti vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2025-4428, CVE-2025-4427 and CVE-2025-22457. The full list is on this page.

### Which Ivanti product has the most vulnerabilities?

Avalanche, with 116 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Ivanti vulnerabilities?

Create a EdgeProtect account and track the Ivanti products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Ivanti?

EdgeProtect keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.edgeprotect.io/register
Book a demo: https://www.edgeprotect.io/contact