{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "ivanti",
    "label": "Ivanti",
    "isStack": false,
    "url": "https://pwn.watch/t/ivanti",
    "feed": "https://pwn.watch/t/ivanti/feed.xml"
  },
  "counts": {
    "incidents": 19,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 18
  },
  "incidents": [
    {
      "slug": "ivanti-connect-secure-cve-2026-104935",
      "title": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935",
      "json": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "Ivanti Connect Secure (ICS)",
      "tags": [
        "ivanti",
        "zero-day",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-104935"
      ],
      "affectedVersions": [
        "25.1.1.1 and prior",
        "25.1.2.2 and prior",
        "22.8R2.4 and prior (22.7.x and below unaffected)"
      ],
      "fixedVersions": [
        "25.1.1.2",
        "25.1.3.0 / 25.1.3.1",
        "22.8R2.5"
      ],
      "startedAt": "2026-10-01",
      "closedAt": null,
      "updatedAt": "2026-10-22T21:57:21+02:00",
      "summary": "Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.",
      "xPost": null
    },
    {
      "slug": "ivanti-sentry-cve-2026-10520",
      "title": "Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520",
      "json": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Ivanti Sentry",
      "tags": [
        "ivanti",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-10520"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-11",
      "closedAt": "2026-06-11",
      "updatedAt": "2026-06-11",
      "summary": "Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Added to CISA KEV on 2026-06-11.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2026-6973",
      "title": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM)",
      "tags": [
        "ivanti",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-6973"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-07",
      "closedAt": "2026-05-07",
      "updatedAt": "2026-05-07",
      "summary": "Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-epm-cve-2026-1603",
      "title": "Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Ivanti  Endpoint Manager (EPM)",
      "tags": [
        "ivanti",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-1603"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-03-09",
      "closedAt": "2026-03-09",
      "updatedAt": "2026-03-09",
      "summary": "Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09.",
      "xPost": null
    },
    {
      "slug": "eu-dutch-ivanti-epmm-zero-day-breach",
      "title": "European Commission & Dutch authorities hit via Ivanti EPMM zero-days",
      "url": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach",
      "json": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti EPMM deployments (EU institutions)",
      "tags": [
        "ivanti",
        "zero-day",
        "data-breach"
      ],
      "cveIds": [
        "CVE-2026-1340"
      ],
      "affectedVersions": [
        "Vulnerable EPMM versions prior to Jan/Feb 2026 patches"
      ],
      "fixedVersions": [
        "Ivanti patched EPMM releases"
      ],
      "startedAt": "2026-02-01",
      "closedAt": "2026-02-28",
      "updatedAt": "2026-02-28",
      "summary": "February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.",
      "xPost": null
    },
    {
      "slug": "ivanti-epmm-cve-2026-1340",
      "title": "Ivanti EPMM code injection CVE-2026-1340 exploited",
      "url": "https://pwn.watch/i/ivanti-epmm-cve-2026-1340",
      "json": "https://pwn.watch/i/ivanti-epmm-cve-2026-1340.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM)",
      "tags": [
        "ivanti",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-1340"
      ],
      "affectedVersions": [
        "See Ivanti Jan 29 2026 advisory"
      ],
      "fixedVersions": [
        "Ivanti patched releases per January 2026 advisory"
      ],
      "startedAt": "2026-01-29",
      "closedAt": "2026-04-30",
      "updatedAt": "2026-04-30",
      "summary": "Ivanti Endpoint Manager Mobile (EPMM) CVE-2026-1340 — unauthenticated RCE via code injection — was exploited in limited attacks disclosed late January 2026. CISA later ordered federal agencies to patch within days in April when adding/prioritizing the KEV entry.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2026-1281",
      "title": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM)",
      "tags": [
        "ivanti",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-1281"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-01-29",
      "closedAt": "2026-01-29",
      "updatedAt": "2026-01-29",
      "summary": "Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-01-29.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427",
      "title": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM)",
      "tags": [
        "ivanti",
        "cisa-kev",
        "rce",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-4427",
        "CVE-2025-4428"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-19",
      "closedAt": "2025-05-19",
      "updatedAt": "2025-05-19",
      "summary": "CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Added to CISA KEV on 2025-05-19.",
      "xPost": null
    },
    {
      "slug": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457",
      "title": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability",
      "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457",
      "json": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways",
      "tags": [
        "ivanti",
        "ransomware",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-22457"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-04-04",
      "closedAt": "2025-04-04",
      "updatedAt": "2025-04-04",
      "summary": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-04-04.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-epm-cve-2024-13159",
      "title": "Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager (EPM)",
      "tags": [
        "ivanti",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-13159",
        "CVE-2024-13160",
        "CVE-2024-13161"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-10",
      "closedAt": "2025-03-10",
      "updatedAt": "2025-03-10",
      "summary": "CVE-2024-13159: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CVE-2024-13160: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CVE-2024-13161: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. Added to CISA KEV on 2025-03-10.",
      "xPost": null
    },
    {
      "slug": "ivanti-connect-secure-zero-day-cve-2025-0282",
      "title": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282",
      "json": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Connect Secure, Policy Secure, ZTA Gateways",
      "tags": [
        "ivanti",
        "vpn",
        "zero-day",
        "rce",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-0282"
      ],
      "affectedVersions": [
        "Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)"
      ],
      "fixedVersions": [
        "Connect Secure 22.7R2.5"
      ],
      "startedAt": "2025-01-08",
      "closedAt": "2025-01-08",
      "updatedAt": "2025-01-08",
      "summary": "An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.",
      "xPost": null
    },
    {
      "slug": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "title": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "json": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)",
      "tags": [
        "ivanti",
        "ivanti-csa",
        "zero-day",
        "sql-injection",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-8190",
        "CVE-2024-8963",
        "CVE-2024-9379",
        "CVE-2024-9380"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-10",
      "closedAt": "2024-10-09",
      "updatedAt": "2024-10-11",
      "summary": "Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.",
      "xPost": null
    },
    {
      "slug": "ivanti-virtual-traffic-manager-cve-2024-7593",
      "title": "Ivanti Virtual Traffic Manager Authentication Bypass",
      "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593",
      "json": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Virtual Traffic Manager",
      "tags": [
        "ivanti",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-7593"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-13",
      "closedAt": "2024-09-24",
      "updatedAt": "2024-09-24",
      "summary": "Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "title": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager (EPM)",
      "tags": [
        "ivanti",
        "ivanti-epm",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2024-29824"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-31",
      "closedAt": "2024-10-02",
      "updatedAt": "2024-10-02",
      "summary": "Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Added to the CISA KEV catalog on 2024-10-02.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529",
      "title": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)",
      "tags": [
        "ivanti",
        "ivanti-epm",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2021-44529"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-25",
      "closedAt": "2024-03-25",
      "updatedAt": "2024-03-25",
      "summary": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2021-44529 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082",
      "title": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082",
      "json": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core",
      "tags": [
        "ivanti",
        "ivanti-epmm",
        "cisa-kev",
        "ransomware",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2023-35082"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-18",
      "closedAt": "2024-01-18",
      "updatedAt": "2024-01-18",
      "summary": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Added to the CISA KEV catalog on 2024-01-18. CISA lists known use in ransomware campaigns. CVE-2023-35082 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "title": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "json": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons",
      "tags": [
        "ivanti",
        "ivanti-connect-secure",
        "vpn",
        "zero-day",
        "auth-bypass",
        "rce",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2023-46805",
        "CVE-2024-21887",
        "CVE-2024-21893"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-10",
      "closedAt": "2024-01-31",
      "updatedAt": "2024-01-31",
      "summary": "Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "ivanti-sentry-cve-2023-38035",
      "title": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)",
      "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035",
      "json": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Sentry",
      "tags": [
        "ivanti",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2023-38035"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-08-22",
      "closedAt": "2023-08-22",
      "updatedAt": "2023-08-22",
      "summary": "Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "ivanti-epmm-norway-government-cve-2023-35078",
      "title": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078",
      "json": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)",
      "tags": [
        "ivanti",
        "epmm",
        "mobileiron",
        "zero-day",
        "auth-bypass",
        "norway",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-35078",
        "CVE-2023-35081"
      ],
      "affectedVersions": [
        "CVE-2023-35078: see vendor advisory",
        "CVE-2023-35081: 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2 (NVD)"
      ],
      "fixedVersions": [
        "CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD)",
        "CVE-2023-35078: see vendor advisory"
      ],
      "startedAt": "2023-07-24",
      "closedAt": "2023-08-15",
      "updatedAt": "2023-08-15",
      "summary": "APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "!Manan",
      "handle": "0xManan",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2020588315171500032/jbdIlDMp_bigger.jpg",
      "text": "welcome.cgi → root.\n\nIvanti Connect Secure CVE-2026-104935. Zero-day. ITW. KEV.\n\nUTA0576 chain (Volexity):\n• public welcome.cgi + X-DSCGI-PATH → hit protected wu.cgi unauth\n• zip-upload race → execute the Perl before delete\n• dsinvoked + in-memory lib patch → root\n• ICT",
      "date": "2026-10-19T09:10:30.000Z",
      "url": "https://x.com/0xManan/status/2112109121621373036",
      "media": [],
      "incident": "ivanti-connect-secure-cve-2026-104935"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 IVANTI CONNECT SECURE ZERO-DAY CHAIN EXPLOITED TO STEAL CREDENTIALS (CVE-2026-104935)\n\nIvanti disclosed a new Connect Secure (ICS) VPN flaw on Oct 13, 2026 and says it is aware of limited exploitation in the wild. CISA added it to the KEV catalog the same day. Volexity https://t.co/o24PhxS5jy",
      "date": "2026-10-13T18:01:14.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2110068357949247657",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HUh3_CObIAAt9bY.jpg"
        }
      ],
      "incident": "ivanti-connect-secure-cve-2026-104935"
    },
    {
      "authorName": "Daily CyberSecurity",
      "handle": "Daily_CyberSec",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg",
      "text": "UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.\n\n#Ivanti #ZeroDay #CVE2026104935 #UTA0576 #Volexity #VPN #ActiveDirectory #Cybersecurity\nhttps://t.co/Yb0bCtOh60",
      "date": "2026-10-13T16:19:58.000Z",
      "url": "https://x.com/Daily_CyberSec/status/2110042871994651025",
      "media": [],
      "incident": "ivanti-connect-secure-cve-2026-104935"
    }
  ],
  "changes": [
    {
      "incident": "ivanti-connect-secure-cve-2026-104935",
      "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-13",
      "title": "Ivanti discloses and patches CVE-2026-104935; Volexity publishes.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935"
    },
    {
      "incident": "ivanti-connect-secure-cve-2026-104935",
      "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-13/16",
      "title": "CISA KEV listing; federal patching deadline reported as Oct 16.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935"
    },
    {
      "incident": "ivanti-connect-secure-cve-2026-104935",
      "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-03",
      "title": "Volexity sees UTA0576 chaining for unauth root.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935"
    },
    {
      "incident": "ivanti-connect-secure-cve-2026-104935",
      "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-03",
      "title": "Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root.",
      "body": null,
      "sourceUrl": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/",
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935"
    },
    {
      "incident": "ivanti-connect-secure-cve-2026-104935",
      "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-01",
      "title": "Defused reports first signs of exploitation.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935"
    },
    {
      "incident": "ivanti-sentry-cve-2026-10520",
      "incidentTitle": "Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-11",
      "title": "CISA added CVE-2026-10520 to the KEV catalog (due 2026-06-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-sentry-cve-2026-10520"
    },
    {
      "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-6973",
      "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-07",
      "title": "CISA added CVE-2026-6973 to the KEV catalog (due 2026-05-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2026-1603",
      "incidentTitle": "Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03-09",
      "title": "CISA added CVE-2026-1603 to the KEV catalog (due 2026-03-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603"
    },
    {
      "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2026-1281",
      "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-01-29",
      "title": "CISA added CVE-2026-1281 to the KEV catalog (due 2026-02-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281"
    },
    {
      "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427",
      "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-19",
      "title": "CISA added CVE-2025-4427 to the KEV catalog (due 2025-06-09).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427"
    },
    {
      "incident": "ivanti-endpoint-manager-mobile-epmm-cve-2025-4427",
      "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-19",
      "title": "CISA added CVE-2025-4428 to the KEV catalog (due 2025-06-09).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427"
    },
    {
      "incident": "ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457",
      "incidentTitle": "Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-04",
      "title": "CISA added CVE-2025-22457 to the KEV catalog (due 2025-04-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-13159",
      "incidentTitle": "Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-10",
      "title": "CISA added CVE-2024-13159 to the KEV catalog (due 2025-03-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-13159",
      "incidentTitle": "Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-10",
      "title": "CISA added CVE-2024-13160 to the KEV catalog (due 2025-03-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-13159",
      "incidentTitle": "Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-10",
      "title": "CISA added CVE-2024-13161 to the KEV catalog (due 2025-03-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159"
    },
    {
      "incident": "ivanti-connect-secure-zero-day-cve-2025-0282",
      "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-08",
      "title": "Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282"
    },
    {
      "incident": "ivanti-connect-secure-zero-day-cve-2025-0282",
      "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-08",
      "title": "Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282"
    },
    {
      "incident": "ivanti-connect-secure-zero-day-cve-2025-0282",
      "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-08",
      "title": "CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-11",
      "title": "FortiGuard Labs details the zero-day chain used against Ivanti CSA",
      "body": null,
      "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-08",
      "title": "CVE-2024-9379 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9379",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-08",
      "title": "CVE-2024-9380 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9380",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "incidentTitle": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-02",
      "title": "CISA added CVE-2024-29824 to the KEV catalog (federal deadline 2024-10-23)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824"
    },
    {
      "incident": "ivanti-virtual-traffic-manager-cve-2024-7593",
      "incidentTitle": "Ivanti Virtual Traffic Manager Authentication Bypass",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-24",
      "title": "CISA added CVE-2024-7593 to the KEV catalog (federal deadline 2024-10-15)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-19",
      "title": "CVE-2024-8963 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-19",
      "title": "CISA added CVE-2024-8963 to the KEV catalog (federal deadline 2024-10-10)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-13",
      "title": "CISA added CVE-2024-8190 to the KEV catalog (federal deadline 2024-10-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-10",
      "title": "CVE-2024-8190 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380",
      "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-10",
      "title": "Ivanti publishes the advisory for CVE-2024-8190",
      "body": null,
      "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
      "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380"
    },
    {
      "incident": "ivanti-virtual-traffic-manager-cve-2024-7593",
      "incidentTitle": "Ivanti Virtual Traffic Manager Authentication Bypass",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-13",
      "title": "CVE-2024-7593 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-7593",
      "url": "https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593"
    },
    {
      "incident": "ivanti-endpoint-manager-epm-cve-2024-29824",
      "incidentTitle": "Ivanti Endpoint Manager (EPM) SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-31",
      "title": "CVE-2024-29824 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-29824",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824"
    },
    {
      "incident": "ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529",
      "incidentTitle": "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-25",
      "title": "CISA added CVE-2021-44529 to the KEV catalog (federal deadline 2024-04-15)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CVE-2024-21893 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-19",
      "title": "CISA issues Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082",
      "incidentTitle": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-18",
      "title": "CISA added CVE-2023-35082 to the KEV catalog (federal deadline 2024-02-08)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-12",
      "title": "CVE-2023-46805 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46805",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-12",
      "title": "CVE-2024-21887 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21887",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-10",
      "title": "CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-10",
      "title": "CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893",
      "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-10",
      "title": "Volexity discloses active exploitation of two Ivanti Connect Secure zero-days",
      "body": null,
      "sourceUrl": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/",
      "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893"
    },
    {
      "incident": "ivanti-sentry-cve-2023-38035",
      "incidentTitle": "Ivanti Sentry: Authentication Bypass (CVE-2023-38035)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-22",
      "title": "CISA added CVE-2023-38035 to the KEV catalog (due 2023-09-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-sentry-cve-2023-38035"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-15",
      "title": "Norway shuts down the old ministry e-mail solution and rolls out a new one",
      "body": null,
      "sourceUrl": "https://www.regjeringen.no/en/whats-new/shutdown-of-e-mail-solution-following-cyberattack/id2991023/",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-01",
      "title": "CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-28",
      "title": "Ivanti patches the second bug, CVE-2023-35081",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-25",
      "title": "CISA adds CVE-2023-35078 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-24",
      "title": "Norway: cyber-attack on the ICT platform used by 12 ministries through a zero-day in a supplier's software",
      "body": null,
      "sourceUrl": "https://www.regjeringen.no/en/whats-new/ministries-hit-by-cyber-attacks/id2990098/",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-23",
      "title": "Ivanti patches CVE-2023-35078",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    }
  ]
}