Exploited CVEs / By vendor / Ivanti
Ivanti vulnerabilities actively exploited
35 Ivanti CVEs on the CISA Known Exploited Vulnerabilities catalog, newest first. Refreshed daily.
Every CVE below is confirmed exploited in the wild, not just theoretically severe. The newest addition is CVE-2026-10520 (Sentry, added 2026-06-11). 12 of the 35 are used in ransomware campaigns. New CISA KEV entries appear here the day they are cataloged; the freshest across all vendors are on exploited this week.
Senserva AI Opinion and rich prompt for Ivanti exploited CVEs
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
Endpoint Manager Mobile (EPMM): 7 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-6973 | Endpoint Manager Mobile (EPMM) | 2026-05-07 | CVSS 7.2, EPSS 34% |
| CVE-2026-1340 | Endpoint Manager Mobile (EPMM) | 2026-04-08 | CVSS 9.8, EPSS 84% |
| CVE-2026-1281 | Endpoint Manager Mobile (EPMM) | 2026-01-29 | CVSS 9.8, EPSS 82% |
| CVE-2025-4427 | Endpoint Manager Mobile (EPMM) | 2025-05-19 | CVSS 7.5, EPSS 100% |
| CVE-2025-4428 | Endpoint Manager Mobile (EPMM) | 2025-05-19 | CVSS 8.8, EPSS 85% |
| CVE-2023-35081 | Endpoint Manager Mobile (EPMM) | 2023-07-31 | CVSS 7.2, EPSS 64% |
| CVE-2023-35078 | Endpoint Manager Mobile (EPMM) | 2023-07-25 | ransomware, CVSS 9.8, EPSS 100% |
Pulse Connect Secure: 7 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2019-11510 | Pulse Connect Secure | 2021-11-03 | ransomware, CVSS 10.0, EPSS 100% |
| CVE-2020-8243 | Pulse Connect Secure | 2021-11-03 | CVSS 7.2, EPSS 91% |
| CVE-2020-8260 | Pulse Connect Secure | 2021-11-03 | CVSS 7.2, EPSS 96% |
| CVE-2021-22893 | Pulse Connect Secure | 2021-11-03 | ransomware, CVSS 10.0, EPSS 47% |
| CVE-2021-22894 | Pulse Connect Secure | 2021-11-03 | CVSS 8.8, EPSS 41% |
| CVE-2021-22899 | Pulse Connect Secure | 2021-11-03 | CVSS 8.8, EPSS 23% |
| CVE-2021-22900 | Pulse Connect Secure | 2021-11-03 | CVSS 7.2, EPSS 14% |
Endpoint Manager (EPM): 5 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-1603 | Endpoint Manager (EPM) | 2026-03-09 | CVSS 7.5, EPSS 81% |
| CVE-2024-13159 | Endpoint Manager (EPM) | 2025-03-10 | CVSS 7.5, EPSS 100% |
| CVE-2024-13160 | Endpoint Manager (EPM) | 2025-03-10 | CVSS 7.5, EPSS 91% |
| CVE-2024-13161 | Endpoint Manager (EPM) | 2025-03-10 | CVSS 7.5, EPSS 90% |
| CVE-2024-29824 | Endpoint Manager (EPM) | 2024-10-02 | CVSS 8.8, EPSS 100% |
Cloud Services Appliance (CSA): 3 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2024-9379 | Cloud Services Appliance (CSA) | 2024-10-09 | CVSS 7.2, EPSS 43% |
| CVE-2024-9380 | Cloud Services Appliance (CSA) | 2024-10-09 | CVSS 7.2, EPSS 63% |
| CVE-2024-8963 | Cloud Services Appliance (CSA) | 2024-09-19 | CVSS 9.1, EPSS 99% |
Other Ivanti products
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-10520 | Sentry | 2026-06-11 | CVSS 10.0, EPSS 100% |
| CVE-2025-22457 | Connect Secure, Policy Secure, and ZTA Gateways | 2025-04-04 | ransomware, CVSS 9.8, EPSS 100% |
| CVE-2025-0282 | Connect Secure, Policy Secure, and ZTA Gateways | 2025-01-08 | ransomware, CVSS 9.0, EPSS 100% |
| CVE-2024-7593 | Virtual Traffic Manager | 2024-09-24 | CVSS 9.8, EPSS 100% |
| CVE-2024-8190 | Cloud Services Appliance | 2024-09-13 | CVSS 7.2, EPSS 89% |
| CVE-2021-44529 | Endpoint Manager Cloud Service Appliance (EPM CSA) | 2024-03-25 | ransomware, CVSS 9.8, EPSS 99% |
| CVE-2024-21893 | Connect Secure, Policy Secure, and Neurons | 2024-01-31 | ransomware, CVSS 8.2, EPSS 100% |
| CVE-2023-35082 | Endpoint Manager Mobile (EPMM) and MobileIron Core | 2024-01-18 | ransomware, CVSS 9.8, EPSS 100% |
| CVE-2023-46805 | Connect Secure and Policy Secure | 2024-01-10 | ransomware, CVSS 8.2, EPSS 100% |
| CVE-2024-21887 | Connect Secure and Policy Secure | 2024-01-10 | ransomware, CVSS 9.1, EPSS 100% |
| CVE-2023-38035 | Sentry | 2023-08-22 | ransomware, CVSS 9.8, EPSS 100% |
| CVE-2019-11539 | Pulse Connect Secure and Pulse Policy Secure | 2021-11-03 | ransomware, CVSS 7.2, EPSS 99% |
| CVE-2020-15505 | MobileIron Multiple Products | 2021-11-03 | CVSS 9.8, EPSS 100% |
Common questions about exploited Ivanti CVEs
Which Ivanti vulnerabilities are actively exploited?
As of August 2026, 35 Ivanti CVEs are on the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is confirmed. The most-listed products are Endpoint Manager Mobile (EPMM) (7), Pulse Connect Secure (7), Endpoint Manager (EPM) (5), Cloud Services Appliance (CSA) (3). 12 are linked to ransomware campaigns.
What is the newest exploited Ivanti CVE?
CVE-2026-10520, affecting Sentry, added to the CISA KEV catalog on 2026-06-11. This page refreshes daily, so the newest entry is always first in the table.
How urgent are these Ivanti CVEs?
KEV listing is the strongest fix-first signal there is: it means confirmed exploitation, not a prediction. Patch these ahead of higher-CVSS issues that nobody is exploiting. Check the vendor advisory (linked below) for fixed versions and workarounds.
Can I ask my own AI about exploited Ivanti CVEs?
Yes. This page includes a free copy-paste AI prompt carrying the newest Ivanti KEV entries, with CVSS, EPSS, and ransomware context, into Claude, ChatGPT, or Copilot. The data is refreshed twice a day (5 AM and 3 PM US Central).
Authoritative references
All vendors, searchable with due dates and CSV export: the exploited-CVE tracker. Every vendor with a page: exploited by vendor.