Ivanti

Security Risk Profile

/100

high

Security Risk Score

Comprehensive risk assessment based on 939 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from May 26, 2016 to present

939

Total CVEs

444

Critical+High

Exploited

430

Unpatched

Threat Assessment

Avg CVSS

Base severity

Avg EPSS

15%

Exploit probability

Unpatched

430

Critical/High

Risk Level

64/100

high

⚠️ 60 Active Exploits⚡ 53 Zero-Days🆕 27Fresh (<7d)📈 38 in Last 30 Days

Severity Distribution

Critical

157

High

287

Medium

106

Low

Exploit Likelihood

>50% chance

20-50%

5-20%

<5%

Age Distribution

Common Weaknesses (CWE)

SQL Injection

Path Traversal

Command Injection

XSS

Buffer Overflow

Most Affected Products

1. Ivanti Connect Secure2514

2. PulseSecure Pulse Connect Secure1129

3. Ivanti Endpoint Manager994

4. Ivanti Policy Secure843

5. PulseSecure Pulse Policy Secure608

Recent Vulnerabilities

See more →

https://reddit.com/r/sysadmin/comments/1xllo8v/cisa_kev_deadline_today_for_ivanti_connect_secure/

unknown

CISA KEV deadline today for Ivanti Connect Secure CVE-2026-111357: the October auth bypass patch did not cover the root escalation. Fixed in 22.8R2.6 and 25.1.1.3

Nov 2, 2026🔧 No Patch

CVE-2026-118527

CVSS 4.3medium

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Oct 30, 2026⚠ Exploited🔧 No Patch

https://reddit.com/r/sysadmin/comments/1x9cq73/weekly_home_lab_exploits/

unknown

Weekly home lab exploits

Oct 18, 2026🔧 No Patch

CVE-2026-111357

CVSS 7.0high

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Oct 15, 2026🔧 No Patch

https://reddit.com/r/sysadmin/comments/1x5ly84/ivanti_connect_secure_zeroday_chain_cve2026104935/

unknown

Ivanti Connect Secure zero-day chain (CVE-2026-104935) got root on a fully patched 22.8R2.4 VPN from October 3, and Ivanti had fixed part of it on one branch in July

Oct 14, 2026🔧 No Patch

CVE-2026-109412

CVSS 9.9critical

Oct 13, 2026🔧 No Patch

CVE-2026-106047

CVSS 7.7high

Oct 13, 2026🔧 No Patch

CVE-2026-106043

CVSS 7.5high

Oct 13, 2026🔧 No Patch

CVE-2026-106042

CVSS 9.9critical