Ivanti Vulnerabilities and Affected Products
Vulnerabilities associated with Endpoint Manager (EPM).
Products
Clear product- Avalanche94 vulnerabilities
- Endpoint Manager71 vulnerabilities
- Connect Secure62 vulnerabilities
- Policy Secure52 vulnerabilities
- endpoint_manager45 vulnerabilities
- EPM33 vulnerabilities
- connect_secure24 vulnerabilities
- policy_secure20 vulnerabilities
- Endpoint Manager Mobile18 vulnerabilities
- Secure Access Client15 vulnerabilities
- ZTA Gateway15 vulnerabilities
- Connect Secure and Policy Secure14 vulnerabilities
- Neurons for Secure Access13 vulnerabilities
- EPMM11 vulnerabilities
- Workspace Control10 vulnerabilities
- automation8 vulnerabilities
- endpoint_manager_mobile8 vulnerabilities
- Endpoint Manager Mobile (EPMM)7 vulnerabilities
- Pulse Connect Secure7 vulnerabilities
- CSA (Cloud Services Appliance)6 vulnerabilities
- endpoint_manager_cloud_services_appliance6 vulnerabilities
- secure_access_client6 vulnerabilities
- Sentry6 vulnerabilities
- Cloud Services Application5 vulnerabilities
- Endpoint Manager (EPM)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-1603HIGH | Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | CVSS8.6v3.1 | EPSS80.6% | PoCs0 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-13159CRITICAL | Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. | CVSS9.8v3.1 | EPSS99.8% | PoCs1 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-13160CRITICAL | Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. | CVSS9.8v3.1 | EPSS91.2% | PoCs0 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-13161CRITICAL | Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. | CVSS9.8v3.1 | EPSS90.1% | PoCs0 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-29824HIGH | Ivanti Endpoint Manager (EPM) SQL Injection VulnerabilityAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. | CVSS8.8v3.1 | EPSS>99.9% | PoCs3 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |