Ivanti security advisories, May 2026

Every Ivanti security advisory published in May 2026, from Ivanti Security Advisories, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 12
Critical: 0
High: 10
In CISA KEV: 1
CVEs: 11

Ivanti advisories published in May 2026

May 22, 2026
High [CVE-2026-8992] improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6
High8.8
May 12, 2026
High [CVE-2026-8111] SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6
High8.8
May 12, 2026
High [CVE-2026-8110] Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6
High7.8
May 12, 2026
High [CVE-2026-7432] race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
High7.8
May 12, 2026
High May 2026 Security Update
HighExploited
May 12, 2026
Medium [CVE-2026-8109] exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6
Medium6.5
May 12, 2026
Medium [CVE-2026-7431] incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6
Medium4.4
May 7, 2026
High [CVE-2026-7821] Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1
High7.4
May 7, 2026
High [CVE-2026-5788] Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1
High7.0
May 7, 2026
High [CVE-2026-5787] Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1
High8.9
May 7, 2026
High [CVE-2026-5786] Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1
High8.8
May 7, 2026
High [CVE-2026-6973] May 2026 EPMM Security Update
HighExploitedCISA KEV

Get an email when Ivanti publishes the next one.

See Ivanti's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Ivanti

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.