Threat database

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CVE-2026-9614 is an improper access control vulnerability in Ivanti Neurons for ITSM (On-Premises) that allows a remote authenticated attacker to gain administrative access. The vulnerability affects both cloud and on-premises versions, but this report focuses on the on-premises product. It has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2026-8992 is a high-severity vulnerability in Ivanti Secure Access Client prior to version 22.8R6. It involves improper certificate validation (CWE-295) that could allow a remote unauthenticated attacker to execute arbitrary code. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been confirmed yet from the vendor. There are no known exploits in the wild at this time.

CVE-2026-8111 is a high-severity SQL injection vulnerability in the web console of Ivanti Endpoint Manager before version 2024 SU6. It allows a remote authenticated attacker to execute arbitrary code remotely. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89). No official patch or remediation guidance is currently confirmed from the vendor. The CVSS score is 8.8, indicating a critical impact on confidentiality, integrity, and availability.

CVE-2026-8110 is a vulnerability in Ivanti Endpoint Manager agent before version 2024 SU6 that involves incorrect permission assignment. This flaw allows a local authenticated attacker to escalate their privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild. The issue relates to improper permission settings on critical resources within the agent software.

CVE-2026-8109 is a medium severity vulnerability in Ivanti Endpoint Manager Core Server versions before 2024 SU6. It involves an exposed dangerous method that allows a remote authenticated attacker to leak access credentials, resulting in a confidentiality breach. The vulnerability does not affect integrity or availability and requires attacker authentication. No official patch or remediation has been confirmed yet, and no exploits are known in the wild.

CVE-2026-8051 is an OS command injection vulnerability in Ivanti Virtual Traffic Manager versions before 22.9r4. It allows a remote authenticated attacker with administrative privileges to execute arbitrary commands on the affected system. The vulnerability is classified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-7432 is a race condition vulnerability in Ivanti Secure Access Client versions before 22.8R6. It allows a locally authenticated user to escalate privileges to SYSTEM due to improper synchronization when accessing shared resources. The vulnerability has a high severity with a CVSS score of 7.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.