Ivanti CVEs, last 30 days (20 CVEs)
CVE Title CVSS Type Status CVE-2026-118527 Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker... 4.3 Unknown/Unlisted Weakness Exploited CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. 9.9 Unknown/Unlisted Weakness Not exploited CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-... 9.9 Unknown/Unlisted Weakness Not exploited CVE-2026-121653 SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution. 9.8 SQL Injection Not exploited CVE-2026-121683 Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core ... 9.4 Unknown/Unlisted Weakness Not exploited CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arb... 7.7 Path Traversal Not exploited CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modif... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-105425 OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 al... 7.2 OS Command Injection Not exploited CVE-2026-18128 Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a... 6.8 Unknown/Unlisted Weakness Not exploited CVE-2026-105426 Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set a... 6.7 Improper Input Validation Not exploited CVE-2026-105669 Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on... 6.7 Unknown/Unlisted Weakness Not exploited CVE-2026-105813 Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session to... 6.3 Unknown/Unlisted Weakness Not exploited CVE-2026-107405 An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of serv... 5.5 Unknown/Unlisted Weakness Not exploited CVE-2026-123179 An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenti... 5.5 Unknown/Unlisted Weakness Not exploited CVE-2026-123181 A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges t... 5.5 Path Traversal Not exploited CVE-2026-106035 An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose ... 5.5 Unknown/Unlisted Weakness Not exploited CVE-2026-106034 A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the hos... 5.0 Path Traversal Not exploited CVE-2026-83528 Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR prote... 4.9 Unknown/Unlisted Weakness Not exploited CVE-2026-107404 Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbit... 4.9 Unknown/Unlisted Weakness Not exploited CVE-2026-105427 Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to perma... 4.9 Improper Input Validation Not exploited