Ivanti Connect Secure vulnerabilities
65 published CVEs name Ivanti Connect Secure among the affected products; CISA lists 5 of them as exploited in the wild.
- Published CVEs
- 65
- Last 12 months
- 3
- Critical
- 16
- Known exploited
- 5
Critical 16High 27Medium 22Low 0Not scored 0
CVEs per yearBy the year they were published
- 20233
- 202430
- 202529
- 20263
Known exploitedNewest addition to KEV first
- CVE-2026-118527
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…
Ivanti · Connect Secure
ExploitedMedium4.3 - CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…
Ivanti · Connect Secure
ExploitedHigh7.0 - CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
Ivanti · Connect Secure
ExploitedHigh8.6 - CVE-2025-22457
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before…
Ivanti · Connect Secure
ExploitedCritical9.0 - CVE-2025-0282
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…
Ivanti · Connect Secure
ExploitedCritical9.0
Newest CVEs
- CVE-2026-118527
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…
Ivanti · Connect Secure
ExploitedMedium4.3 - CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…
Ivanti · Connect Secure
ExploitedHigh7.0 - CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
Ivanti · Connect Secure
ExploitedHigh8.6 - CVE-2025-55144
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
Ivanti · Connect Secure
Medium5.4 - CVE-2025-55143
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
Ivanti · Connect Secure
Medium6.1 - CVE-2025-55142
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
Ivanti · Connect Secure
High8.8 - CVE-2025-55141
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
Ivanti · Connect Secure
High8.8 - CVE-2025-55139
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…
Ivanti · Connect Secure
Medium6.8 - CVE-2025-55148
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
Ivanti · Connect Secure
High7.6 - CVE-2025-55147
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…
Ivanti · Connect Secure
High8.8