Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1281 & CVE-2026-1340)

Update 29 Jan: Step by Step RPM Install KB included Update 4 Feb: Fixed in Security Update: 0S-4 and 0L-4 included Update: 6 Feb: RPM detection script available to help customers assess potential impact. Technical Analysis updated with reliable Indicators of Compromise IoC’s. Both in partnership...

Security Advisory Ivanti Endpoint Manager (EPM) October 2025

Security Advisory Ivanti Endpoint Manager EPM October 2025 Multiple CVEs Summary Update Nov. 11, 2025: A fix has been released for CVE-2025-11622 and CVE-2025-9713. To resolve these vulnerabilities customers should update to EPM 2024 SU4. Update Feb. 10, 2026: A fix to resolve the remaining CVE's...

Security Advisory Ivanti Workspace Control (IWC)

Summary Ivanti has released a version of a new product architecture for Ivanti Workspace Control IWC which addresses high and critical vulnerabilities. Successful exploitation could lead to an escalation of privileges and lateral movement. IWC is intended to be a non-internet facing product, and...

Security Advisory EPM September 2024 for EPM 2024 and EPM 2022

Update Regarding Ivanti EPM Endpoint Manager Downloads As part of our ongoing efforts to enhance your experience and streamline our processes we have migrated the software downloads from the Ivanti Community to the Ivanti License System ILS. You will continue to use your current Ivanti Single...

Security Advisory: Ivanti Neurons for ITSM (CVE-2024-7569, CVE-2024-7570)

Ivanti has released updates for Ivanti Neurons for ITSM which addresses a critical severity vulnerability and a high severity vulnerability. Please note: the patch has been applied to all Ivanti Neurons for ITSM Cloud landscapes as of August 4. No further action is needed for cloud customers, we...

Avalanche 6.4.3.602 - additional security hardening and CVE fixed

Last Modified Date Aug 16, 2024 6:00:39 PM...

SA40107 - Response to Juniper ScreenOS security advisory JSA10713 (CVE-2015-7755 and CVE-2015-7756)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Juniper announced a security advisory for their Netscreen Firewall ScreenOS product portfolio. The Juniper ScreenOS advisory can be found here: JSA10713 Related Links JSA10713...

SA40210 - [Pulse Secure] Information disclosure possible on admin UI (CVE-2016-4791)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An information disclosure issue was discovered on the Pulse Connect Secure device. This issue exists on the administrative user interface and requires admin level access. Because of th...

SA40384 - November 11, 2016 OpenSSL Security Advisory

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On November 11, 2016 the OpenSSL project announced a group of new security vulnerabilities. Pulse Secure evaluates all current supported versions of Pulse Secure products. For a list of...

SA44588 - 2020-09: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.1R8.2

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This advisory provides information about multiple vulnerabilities resolved in Pulse Connect Secure 9.1R8.2, Pulse Policy Secure 9.1R8.2 Refer to KB43892 - What releases will Pulse Secur...

Security Advisory Ivanti Xtraction (CVE-2026-14902, CVE-2026-14903)

Update 18th July: Updated patch available to address functionality impact Ivanti has released updates for Ivanti Xtraction which addresses one medium and one high vulnerability. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...

Using Vulnerable Libssh Version < 0.12 in Sentry

Last Modified Date Apr 20, 2026 4:13:44 AM...

Security Advisory Ivanti Neurons for ITSM (CVE-2026-4913, CVE-2026-4914)

Ivanti has released updates for Ivanti Neurons for ITSM which addresses two medium severity vulnerabilities We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score Severity | CVSS Vector | C...

Impact Of CVE-2025-32462, CVE-2025-32463 On Ivanti EPMM and Sentry

Last Modified Date Oct 16, 2025 7:23:33 PM...

Security Advisory Ivanti Neurons for ITSM (On-Premises Only) (CVE-2025-22462)

Security Advisory Ivanti Neurons for ITSM on-premises only CVE-2025-22462 Summary Ivanti has released updates for Ivanti Neurons for ITSM on-prem only which addresses one critical severity vulnerability. Depending on system configuration, successful exploitation could allow an unauthenticated...

December 2024 Security Advisory Ivanti Automation (CVE-2024-9845)

Summary Ivanti has released updates for Automation which addresses one high severity vulnerability. Successful exploitation could lead to local privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CVE Numbe...

Security Advisory EPM November 2024 for EPM 2024 and EPM 2022 SU6

Update Regarding Ivanti EPM Endpoint Manager Downloads As part of our ongoing efforts to enhance your experience and streamline our processes we have migrated the software downloads from the Ivanti Community to the Ivanti License System ILS. You will continue to use your current Ivanti Single...

Ivanti Avalanche 6.4.5 Security Advisory (Multiple CVE's)

Summary Ivanti has released updates for Ivanti Avalanche which addresses high severity vulnerabilities. Successful exploitation could lead to information disclosure, authentication bypass or denial of service. We are not aware of any customers being exploited by these vulnerabilities at the time ...

Security Advisory Ivanti CSA 4.6 (Cloud Services Appliance) (CVE-2024-8963)

Summary Ivanti is disclosing a critical vulnerability in Ivanti CSA 4.6 which was incidentally addressed in the patch released on 10 September CSA 4.6 Patch 519. Successful exploitation could allow a remote unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in...

Security Advisory Ivanti Cloud Service Appliance (CSA) (CVE-2024-8190)

Summary Ivanti has released a security update for Ivanti CSA 4.6 which addresses a high severity vulnerability. Successful exploitation could lead to unauthorized access to the device running the CSA. Dual-homed CSA configurations with eth0 as an internal network, as recommended by Ivanti, are at...

SA: CVE-2023-46808 (Authenticated Remote File Write) for Ivanti Neurons for ITSM

Last Modified Date Apr 4, 2024 4:10:39 PM...

Avalanche 6.4.3 Security Hardening and CVEs addressed

Avalanche 6.4.3 has addressed some new security hardening and vulnerabilities in our Q1 2024 release. We are not aware of any exploitation of these vulnerabilities at the time of disclosure. To address the security vulnerabilities listed below, it is highly recommended to download the Avalanche...

SA-2023-12-19-CVE-2023-39336

SECURITY ADVISORY 2023-12-19 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU4 and all prior versions. More information can be found here: CVE-2023-39336 Full details Please log into the community to access the full details page. Vulnerability...

KB API Authentication Bypass on Sentry Administrator Interface - CVE-2023-38035

A vulnerability has been discovered in Ivanti Sentry, formerly MobileIron Sentry. This vulnerability impacts all supported versions – 9.18, 9.17, and 9.16. Older versions/releases are also at risk. This vulnerability does not affect other Ivanti products or solutions, such as Ivanti EPMM,...

JSA10482 - 2011-07 Out of Cycle Security Bulletin: Multiple Products; TLS/SSL Renegotiation Vulnerability (CVE-2009-3555)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. CVE-2009-3555 summary: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, does not properly associate renegotiation handshakes with an existing connection, which allows...

SA40166 - Remote desktop protocol (RDP) client restriction bypass issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A security issue was discovered in the PCS Terminal Services Remote Desktop Protocol RDP client session restrictions feature. By exploiting this issue a malicious authenticated user...

Security Advisory EPM July 2024 for EPM 2024

Last Modified Date Apr 16, 2025 2:50:24 PM...

CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure

Executive Summary: As part of the ongoing investigation, we discovered a new vulnerability as part of our internal review and testing of our code, which was also responsibly disclosed by watchTowr. This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure...

CVE-2023-35081 - Remote Arbitrary File Write

A vulnerability has been discovered in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron Core. This vulnerability impacts all supported versions –releases 11.10, 11.9 and 11.8. Older versions/releases are also at risk. This vulnerability is different from CVE-2023-35078, released ...

ZDI-CAN-17729 - CVE-2023-28125 - Bug 958437: ZDI-CAN-17729: Ivanti Avalanche InfoRail Authentication Bypass Vulnerability

Last Modified Date 2024-3-8 16:51:05...

JSA10590 - 2013-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Crafted packet can cause denial of service

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A denial of service DoS issue has been found on the Pulse Connect Secure PCS and Pulse Policy Secure PPS devices. This issue can cause the system to hang ultimately requiring a restart ...

JSA10617 - 2014-03 Security Bulletin: Pulse Connect Secure: Cross site scripting issue (CVE-2014-2291)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure product. The problem is a result of incorrect user input validation on the web server. The issue exists within a...

JSA10401 - Pulse Connect Secure (PCS) product - PCS Security Bundle - Internal System Function

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Internal System Function vulnerabilities found and fixed through a combination of internal and external proactive security testing: Issue with special characters used in a parameter in...

SA40013 - TLS/SSL Renegotiation Vulnerability Pulse Connect Secure (PCS) (CVE-2009-3555) (Pulse Secure PSN-2009-11-573

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The industry-wide TLS/SSL renegotiation issue CVE-2009-3555 has been found in the Pulse Connect Secure PCS device. This issue has been reported as a man in the middle MITM attack by ma...

SA40007 - 2014-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Secure Desktop client: User privilege escalation issue in Installer Service (CVE-2014-3811)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A privilege escalation issue has been found and corrected in the Pulse Secure Installer Service client Windows platform only software. This issue could allow a non-administrator user t...

JSA10645 - 2014-09 Security Bulletin: Pulse Connect Secure (PSC) and Pulse Policy Secure (PPS): Cross site scripting issue (CVE-2014-3820)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure and Pulse Policy Secure PCS/PPS products. The problem is a result of incorrect user input validation on the PCS/P...

SA40208 - [Pulse Secure] Single specific file content disclosure issue (CVE-2016-4788)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue was discovered with the Pulse Connect Secure device that could allow an attacker to print out contents from a specific file. The file contents do not contain any configuration...

SA40211 - [Pulse Secure] Cross site scripting issue (CVE-2016-4790)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been discovered in the Pulse Connect Secure device. This issue exists in a file that is located in the authenticated area of the administrative user...

SA40212 - [Pulse Secure] Sign in page disclosure issue (CVE-2016-4792)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue was found on the Pulse Connect Secure device that could allow disclosure of sign in pages. The security of the pages is not affected by this issue. This issue was assigned:...

SA40971 - Pulse One On-Premise Remote Information Disclosure Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Pulse One On-Premise software version 2.0.1649 does not properly validate requests which allows remote users to query and obtain sensitive information. This issue is exploitable only f...

JSA10399 - Security Vulnerability in Pulse Policy Secure (PPS) software's radius authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This Security Advisory is an addendum to JSA10380.. The purpose is to notify customers of the removal of the affected releases from the Pulse Secure software download site. JSA10380 -...

SA43681 - 2016-11: CSRF vulnerability with Brocade Virtual Traffic Manager (vTM) (CVE-2016-8201)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A CSRF vulnerability in Pulse Secure Virtual Traffic Manager versions released prior to and including 11.0, could allow an attacker to trick a logged-in user into making administrative...

SA43877 - 2018-08 Security Bulletin: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure / Pulse Secure Desktop 9.0R1/9.0R2

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This advisory provides information about multiple vulnerabilities resolved in Pulse Connect Secure and Pulse Policy Secure 9.0R1 & Pulse Desktop Client 9.0R2 releases. These issues app...

SA44114 - 2019-04: Out-of-Cycle Advisory: Pulse Desktop Client and Network Connect improper handling of session cookies (CVE-2019-11213)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Under certain conditions, the Pulse Desktop Client and Network Connect could allow an attacker to access session tokens to replay and spoof sessions, and as a result, gain unauthorized...

SA44426 - 2020-04: Out-of-Cycle Advisory: Multiple Host Checker Vulnerabilities

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This advisory provides information about the Host Checker policy enforcement vulnerabilities highlighted in CVE-2020-11580, CVE-2020-11581, and CVE-2020-11582. These vulnerabilities...

SA44800 - 2021-05: Out-of-Cycle Advisory: Pulse Connect Secure Buffer Overflow Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A vulnerability was discovered under Pulse Connect Secure PCS. This includes buffer overflow vulnerability on the Pulse Connect Secure gateway that allows a remote authenticated user...

SA44790 - HTTP Request Smuggling vulnerability with Virtual Traffic Manager (vTM)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager could allow an attacker to 'smuggle' an HTTP request through an HTTP/2 header. In particular, customers...

SA45520 - CVE's (CVE-2022-35254,CVE-2022-35258) may lead to DoS attack

Summary: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure ICS in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R3, Ivanti Policy Secure IPS in versions prior to 9.1R17 and 22.2R3, and Ivanti Neurons for Zero-Trust Gateway in...

September Security Advisory Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access (Multiple CVEs)

Update 10 Sept Ivanti Policy Secure: Affected and Resolved in Versions updated Summary Ivanti has released updates for Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access which addresses six medium and five high vulnerabilities. We are not aware of any customers being...

Security Advisory - Ivanti Application Control Engine (CVE-2024-10630)

Summary Ivanti has released updates for Ivanti Application Control Engine which address a high severity vulnerability. Successful exploitation could lead to bypassing configured protections. We are not aware of any customers being exploited by this vulnerability at the time of disclosure...