# Ivanti security incidents · pwn.watch

> Security incidents tagged Ivanti (vendor, product, platform or attack type).

Page: https://pwn.watch/t/ivanti · generated 2026-10-22T17:40:31.642Z

## Status (as of 2026-10-22)
- Incidents: 19 (1 live, 1 live and not fully patched, 18 patched)
- Days without a Ivanti security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-01

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/ivanti.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/ivanti/feed.xml
- This file: https://pwn.watch/t/ivanti/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935) ([json](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json)): high, live, partial, started 2026-10-01, CVE-2026-104935
- [Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability](https://pwn.watch/i/ivanti-sentry-cve-2026-10520) ([json](https://pwn.watch/i/ivanti-sentry-cve-2026-10520.json)): high, closed, patched, started 2026-06-11, CVE-2026-10520
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json)): high, closed, patched, started 2026-05-07, CVE-2026-6973
- [Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603) ([json](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json)): high, closed, patched, started 2026-03-09, CVE-2026-1603
- [European Commission & Dutch authorities hit via Ivanti EPMM zero-days](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach) ([json](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json)): critical, closed, patched, started 2026-02-01, CVE-2026-1340
- [Ivanti EPMM code injection CVE-2026-1340 exploited](https://pwn.watch/i/ivanti-epmm-cve-2026-1340) ([json](https://pwn.watch/i/ivanti-epmm-cve-2026-1340.json)): critical, closed, patched, started 2026-01-29, CVE-2026-1340
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json)): high, closed, patched, started 2026-01-29, CVE-2026-1281
- [Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json)): high, closed, patched, started 2025-05-19, CVE-2025-4427, CVE-2025-4428
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457) ([json](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json)): critical, closed, patched, started 2025-04-04, CVE-2025-22457
- [Ivanti Endpoint Manager (EPM): 3 exploited vulnerabilities (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161)](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159) ([json](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-13159.json)): critical, closed, patched, started 2025-03-10, CVE-2024-13159, CVE-2024-13160, CVE-2024-13161
- [Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json)): critical, closed, patched, started 2025-01-08, CVE-2025-0282
- [Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380) ([json](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json)): critical, closed, patched, started 2024-09-10, CVE-2024-8190, CVE-2024-8963, CVE-2024-9379…
- [Ivanti Virtual Traffic Manager Authentication Bypass](https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593) ([json](https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593.json)): critical, closed, patched, started 2024-08-13, CVE-2024-7593
- [Ivanti Endpoint Manager (EPM) SQL Injection](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824) ([json](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824.json)): critical, closed, patched, started 2024-05-31, CVE-2024-29824
- [Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529) ([json](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json)): critical, closed, patched, started 2024-03-25, CVE-2021-44529
- [Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json)): critical, closed, patched, started 2024-01-18, CVE-2023-35082
- [Ivanti Connect Secure zero-days chained for mass VPN compromise](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json)): critical, closed, patched, started 2024-01-10, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
- [Ivanti Sentry: Authentication Bypass (CVE-2023-38035)](https://pwn.watch/i/ivanti-sentry-cve-2023-38035) ([json](https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json)): critical, closed, patched, started 2023-08-22, CVE-2023-38035
- [Ivanti EPMM zero-days used to breach 12 Norwegian ministries](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078) ([json](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json)): critical, closed, patched, started 2023-07-24, CVE-2023-35078, CVE-2023-35081