Ivanti security advisories, October 2026

Every Ivanti security advisory published in October 2026, from Ivanti Security Advisories, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 9
Critical: 2
High: 4
In CISA KEV: 2
CVEs: 8

Ivanti advisories published in October 2026

Oct 15, 2026
High [CVE-2026-111357] Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026
High7.0ExploitedCISA KEV
Oct 13, 2026
Critical [CVE-2026-109412] exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information
Critical9.9
Oct 13, 2026
Critical [CVE-2026-106042] External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application
Critical9.9
Oct 13, 2026
High [CVE-2026-106047] Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files
High7.7
Oct 13, 2026
High [CVE-2026-106043] Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site
High7.5
Oct 13, 2026
High [CVE-2026-104935] Connect Secure: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
High8.6ExploitedCISA KEV
Oct 13, 2026
Medium [CVE-2026-106035] Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log
Medium5.5
Oct 13, 2026
Medium [CVE-2026-106034] Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system
Medium5.0
Oct 13, 2026
Advisory October 2026 Security Update
UnratedExploited

Get an email when Ivanti publishes the next one.

See Ivanti's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Ivanti

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.