Ivanti Security Advisories & CVEs
6 advisories tracked · Ivanti Security Advisories · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Ivanti CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your Ivanti device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Ivanti's recent advisories.
Official source
Ivanti Security Advisories
Polled via Ivanti's official Security Advisory blog RSS. Posts summarize each monthly/out-of-band advisory and link to the canonical Ivanti Security Advisory KB. Ivanti Connect Secure, Policy Secure and EPMM are frequent, high-priority exploitation targets.
Latest Ivanti advisories
Medium [CVE-2026-106035] Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.
Medium [CVE-2026-106034] Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
Medium [CVE-2026-14902] open redirect in Ivanti Xtraction before version 2026.2.1
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Medium [CVE-2026-8109] exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
Medium [CVE-2026-7431] incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6
An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.
Medium [CVE-2024-9379] CSA (Cloud Services Appliance): SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Affected product named by the advisory: CSA (Cloud Services Appliance).