Ivanti Endpoint Manager
71 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-18129 | fixed in 2024 SU7 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticat | HIGH 8.1 | 1.5 % | ||
| CVE-2026-18127 | fixed in 2024 SU7 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full wr | HIGH 7.7 | 0.7 % | ||
| CVE-2026-18125 | fixed in 2024 SU7 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an a | HIGH 7.5 | 1.6 % | ||
| CVE-2026-8111 | fixed in 2024 SU6 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote | HIGH 8.8 | 6.3 % | ||
| CVE-2026-8110 | fixed in 2024 SU6 | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to es | HIGH 7.8 | 0.2 % | ||
| CVE-2026-8109 | fixed in 2024 SU6 | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-1603 | fixed in 2024 SU5 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored | HIGH 8.6 | 88 % | KEV | |
| CVE-2026-1602 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-13662 | fixed in 2024 SU4 SR1 | Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 | HIGH 7.8 | 0.6 % | ||
| CVE-2025-13661 | fixed in 2024 SU4 SR1 | Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs | HIGH 8.0 | 1.4 % | ||
| CVE-2025-13659 | fixed in 2024 SU4 SR1 | Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic | HIGH 8.8 | 2.0 % | ||
| CVE-2025-10573 | fixed in 2024 SU4 SR1 | Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript | CRITICAL 9.6 | 33 % | ||
| CVE-2025-10918 | fixed in 2024 SU4 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write | HIGH 7.1 | 0.2 % | ||
| CVE-2025-62384 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62386 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62383 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62391 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62385 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62387 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 1.7 % | ||
| CVE-2025-62388 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-62389 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 1.7 % | ||
| CVE-2025-62390 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 1.7 % | ||
| CVE-2025-62392 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-11623 | fixed in 2024 SU5 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-9713 | fixed in 2024 SU4 | Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. | HIGH 8.8 | 15 % | ||
| CVE-2025-11622 | fixed in 2024 SU4 | Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileg | HIGH 7.8 | 0.8 % | ||
| CVE-2025-9872 | fixed in 2024 SU3 Security Release 1, 2022 SU8 Security Release 2 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to | HIGH 8.8 | 17 % | ||
| CVE-2025-9712 | fixed in 2024 SU3 Security Release 1, 2022 SU8 Security Release 2 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to | HIGH 8.8 | 24 % | ||
| CVE-2025-7037 | fixed in 2024 SU3, 2022 SU8 | SQL injection in Ivanti Endpoint Manager | HIGH 7.2 | 0.9 % | ||
| CVE-2025-6996 | fixed in 2024 SU3, 2022 SU8 | Improper Encryption in Ivanti Endpoint Manager | HIGH 8.4 | 0.2 % | ||
| CVE-2025-6995 | fixed in 2024 SU3, 2022 SU8 | Improper Encryption in Ivanti Endpoint Manager | HIGH 8.4 | 0.2 % | ||
| CVE-2025-22466 | fixed in 2024 SU1, 2022 SU7 | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obta | CRITICAL 9.6 | 1.4 % | ||
| CVE-2025-22465 | fixed in 2024 SU1, 2022 SU7 | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to exec | MEDIUM 6.1 | 0.7 % | ||
| CVE-2025-22464 | fixed in 2024 SU1, 2022 SU7 | An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attac | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-22461 | fixed in 2024 SU1, 2022 SU7 | SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admi | HIGH 7.2 | 1.5 % | ||
| CVE-2025-22459 | fixed in 2024 SU1, 2022 SU7 | Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticate | MEDIUM 4.8 | 0.4 % | ||
| CVE-2025-22458 | fixed in 2024 SU1, 2022 SU7 | DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to | HIGH 7.8 | 0.4 % | ||
| CVE-2024-13162 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authentic | HIGH 7.2 | 65 % | ||
| CVE-2024-13163 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow | HIGH 7.8 | 9.2 % | ||
| CVE-2024-13164 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a loca | HIGH 7.8 | 0.4 % | ||
| CVE-2024-13165 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | HIGH 7.5 | 2.8 % | ||
| CVE-2024-13166 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | HIGH 7.5 | 2.5 % | ||
| CVE-2024-13167 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | HIGH 7.5 | 2.8 % | ||
| CVE-2024-13168 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | HIGH 7.5 | 2.8 % | ||
| CVE-2024-13169 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local au | HIGH 7.8 | 0.4 % | ||
| CVE-2024-13170 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | HIGH 7.5 | 2.8 % | ||
| CVE-2024-13171 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows | HIGH 7.8 | 18 % | ||
| CVE-2024-13172 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows | HIGH 7.8 | 0.5 % | ||
| CVE-2024-13158 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow | HIGH 7.2 | 3.4 % | ||
| CVE-2024-13159 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2024-13160 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | CRITICAL 9.8 | 91 % | KEV | |
| CVE-2024-13161 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | CRITICAL 9.8 | 90 % | KEV | |
| CVE-2024-10811 | fixed in 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote | CRITICAL 9.8 | 3.5 % | ||
| CVE-2024-10256 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. | HIGH 7.1 | 0.2 % | ||
| CVE-2024-50330 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent | CRITICAL 9.8 | 40 % | ||
| CVE-2024-50329 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthen | HIGH 8.8 | 1.8 % | ||
| CVE-2024-50328 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.8 % | ||
| CVE-2024-50327 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.1 % | ||
| CVE-2024-50326 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 26 % | ||
| CVE-2024-50324 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenti | HIGH 7.2 | 19 % | ||
| CVE-2024-50323 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenti | HIGH 7.8 | 0.7 % | ||
| CVE-2024-50322 | fixed in 2024 November Security Update, 2022 SU6 November Security Update | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent | HIGH 7.8 | 6.0 % | ||
| CVE-2024-8441 | fixed in 2022 SU6, 2024 September Security Update | An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker w | MEDIUM 6.7 | 0.4 % | ||
| CVE-2024-8322 | fixed in 2022 SU6, 2024 September Security Update | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker t | HIGH 8.8 | 1.1 % | ||
| CVE-2024-8321 | fixed in 2022 SU6, 2024 September Security Update | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated atta | HIGH 8.6 | 1.8 % | ||
| CVE-2024-8320 | fixed in 2022 SU6, 2024 September Security Update | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated atta | MEDIUM 5.3 | 1.2 % | ||
| CVE-2024-8191 | fixed in 2022 SU6, 2024 September Security Update | SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker | CRITICAL 9.8 | 20 % | ||
| CVE-2023-39336 | | An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the int | CRITICAL 9.6 | 10.0 % | ||
| CVE-2023-35083 | | Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all pre | MEDIUM 6.5 | 1.6 % | ||
| CVE-2023-35084 | | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous | CRITICAL 9.8 | 3.8 % | ||
| CVE-2023-35077 | 7.9.1.285 – < 7.9.1.285 | An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product | HIGH 8.1 | 2.2 % |