pwn.watch: Ivanti incident updates

[high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Thu, 22 Oct 2026 20:41:14 GMT

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.

Status: live · Patch: partial · Fixed in: 25.1.1.2, 25.1.3.0 / 25.1.3.1, 22.8R2.5

Latest updates:

2026-10-13: Ivanti discloses and patches CVE-2026-104935; Volexity publishes.
2026-10-13/16: CISA KEV listing; federal patching deadline reported as Oct 16.
2026-10-03: Volexity sees UTA0576 chaining for unauth root.

CVEs: CVE-2026-104935

[high] Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability

Thu, 11 Jun 2026 00:00:00 GMT

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors. Added to CISA KEV on 2026-06-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-11: CISA added CVE-2026-10520 to the KEV catalog (due 2026-06-14).

CVEs: CVE-2026-10520

[high] Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Thu, 07 May 2026 00:00:00 GMT

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA KEV on 2026-05-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-07: CISA added CVE-2026-6973 to the KEV catalog (due 2026-05-10).

CVEs: CVE-2026-6973

[critical] Ivanti EPMM code injection CVE-2026-1340 exploited

Thu, 30 Apr 2026 00:00:00 GMT

Ivanti Endpoint Manager Mobile (EPMM) CVE-2026-1340 — unauthenticated RCE via code injection — was exploited in limited attacks disclosed late January 2026. CISA later ordered federal agencies to patch within days in April when adding/prioritizing the KEV entry.

Status: closed · Patch: patched · Fixed in: Ivanti patched releases per January 2026 advisory

CVEs: CVE-2026-1340

[high] Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Mon, 09 Mar 2026 00:00:00 GMT

Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-09: CISA added CVE-2026-1603 to the KEV catalog (due 2026-03-23).

CVEs: CVE-2026-1603

[critical] European Commission & Dutch authorities hit via Ivanti EPMM zero-days

Sat, 28 Feb 2026 00:00:00 GMT

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

Status: closed · Patch: patched · Fixed in: Ivanti patched EPMM releases

CVEs: CVE-2026-1340

[high] Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Thu, 29 Jan 2026 00:00:00 GMT

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. Added to CISA KEV on 2026-01-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-01-29: CISA added CVE-2026-1281 to the KEV catalog (due 2026-02-01).

CVEs: CVE-2026-1281

[high] Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)

Mon, 19 May 2025 00:00:00 GMT

CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Added to CISA KEV on 2025-05-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-19: CISA added CVE-2025-4427 to the KEV catalog (due 2025-06-09).
2025-05-19: CISA added CVE-2025-4428 to the KEV catalog (due 2025-06-09).

CVEs: CVE-2025-4427, CVE-2025-4428

[critical] Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Fri, 04 Apr 2025 00:00:00 GMT

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-04-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-04: CISA added CVE-2025-22457 to the KEV catalog (due 2025-04-11).

CVEs: CVE-2025-22457

[critical] Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)

Mon, 10 Mar 2025 00:00:00 GMT

CVE-2024-13159: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CVE-2024-13160: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. CVE-2024-13161: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. Added to CISA KEV on 2025-03-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-10: CISA added CVE-2024-13159 to the KEV catalog (due 2025-03-31).
2025-03-10: CISA added CVE-2024-13160 to the KEV catalog (due 2025-03-31).
2025-03-10: CISA added CVE-2024-13161 to the KEV catalog (due 2025-03-31).

CVEs: CVE-2024-13159, CVE-2024-13160, CVE-2024-13161

[critical] Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)

Wed, 08 Jan 2025 00:00:00 GMT

An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Status: closed · Patch: patched · Fixed in: Connect Secure 22.7R2.5

Latest updates:

2025-01-08: Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5 (source)
2025-01-08: Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware (source)
2025-01-08: CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions (source)

CVEs: CVE-2025-0282

[critical] Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor

Fri, 11 Oct 2024 00:00:00 GMT

Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-11: FortiGuard Labs details the zero-day chain used against Ivanti CSA (source)
2024-10-09: CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30) (source)
2024-10-09: CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30) (source)

CVEs: CVE-2024-8190, CVE-2024-8963, CVE-2024-9379, CVE-2024-9380

[critical] Ivanti Endpoint Manager (EPM) SQL Injection

Wed, 02 Oct 2024 00:00:00 GMT

Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Added to the CISA KEV catalog on 2024-10-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-02: CISA added CVE-2024-29824 to the KEV catalog (federal deadline 2024-10-23) (source)
2024-05-31: CVE-2024-29824 published (source)

CVEs: CVE-2024-29824

[critical] Ivanti Virtual Traffic Manager Authentication Bypass

Tue, 24 Sep 2024 00:00:00 GMT

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-24: CISA added CVE-2024-7593 to the KEV catalog (federal deadline 2024-10-15) (source)
2024-08-13: CVE-2024-7593 published (source)

CVEs: CVE-2024-7593

[critical] Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection

Mon, 25 Mar 2024 00:00:00 GMT

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2021-44529 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-03-25: CISA added CVE-2021-44529 to the KEV catalog (federal deadline 2024-04-15) (source)

CVEs: CVE-2021-44529

[critical] Ivanti Connect Secure zero-days chained for mass VPN compromise

Wed, 31 Jan 2024 00:00:00 GMT

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-31: CVE-2024-21893 published (source)
2024-01-31: CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02) (source)
2024-01-31: CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02 (source)

CVEs: CVE-2023-46805, CVE-2024-21887, CVE-2024-21893

[critical] Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass

Thu, 18 Jan 2024 00:00:00 GMT

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Added to the CISA KEV catalog on 2024-01-18. CISA lists known use in ransomware campaigns. CVE-2023-35082 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-18: CISA added CVE-2023-35082 to the KEV catalog (federal deadline 2024-02-08) (source)

CVEs: CVE-2023-35082

[critical] Ivanti Sentry: Authentication Bypass (CVE-2023-38035)

Tue, 22 Aug 2023 00:00:00 GMT

Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-08-22: CISA added CVE-2023-38035 to the KEV catalog (due 2023-09-12).

CVEs: CVE-2023-38035

[critical] Ivanti EPMM zero-days used to breach 12 Norwegian ministries

Tue, 15 Aug 2023 00:00:00 GMT

APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).

Status: closed · Patch: patched · Fixed in: CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD), CVE-2023-35078: see vendor advisory

Latest updates:

2023-08-15: Norway shuts down the old ministry e-mail solution and rolls out a new one (source)
2023-08-01: CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023 (source)
2023-07-28: Ivanti patches the second bug, CVE-2023-35081

CVEs: CVE-2023-35078, CVE-2023-35081