Threat database

CVE-2026-111357 is a high-severity vulnerability in Ivanti Connect Secure version 22.8R2.4. It involves improper handling of DSCache configuration data by the dsinvoked broker, which can be exploited to escalate privileges to root. This vulnerability was observed being exploited in the wild in October 2026.

CVE-2026-109412 is a critical vulnerability in Ivanti Neurons Patch for Intune involving an exposed dangerous endpoint that allows a remote authenticated attacker to leak sensitive authentication information. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

CVE-2026-106047 is a path traversal vulnerability in Ivanti Xtraction's template export functionality that affects versions before 2026.4. It allows a remote authenticated attacker to read arbitrary files on the system. The vulnerability has a high severity with a CVSS score of 7.7. No specific affected versions are provided beyond being prior to 2026.4. There is no information about available patches or vendor advisories. The vulnerability requires authentication and does not impact integrity or availability.

CVE-2026-106043 is a vulnerability in Ivanti Xtraction before version 2026.4 where a critical function lacks proper authentication. This flaw allows a remote unauthenticated attacker to create or modify trusted sites within the application. The vulnerability has a high severity score of 7.5 and impacts the integrity of the system without affecting confidentiality or availability.

CVE-2026-106042 is a critical vulnerability in Ivanti Xtraction before version 2026.4 involving external control of file name or path. It allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and capture EPMM connector credentials transmitted by the application.

CVE-2026-106035 is an information exposure vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4. It allows a remote authenticated attacker with low privileges to disclose partial SQL database passwords through application log files. The vulnerability does not impact integrity or availability but has a high confidentiality impact. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-106034 is a path traversal vulnerability in Ivanti Xtraction before version 2026.4. It allows a remote authenticated attacker to create or modify arbitrary directories on the host file system. The vulnerability requires low attack complexity and no user interaction but does require authentication with privileges. The impact is limited to integrity, with no confidentiality or availability impact reported. The CVSS score is 5.0, indicating a medium severity level.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CVE-2026-12647 is a critical missing authorization vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server, impacting confidentiality, integrity, and availability.

CVE-2026-12646 is a critical Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-12645 is a critical missing authorization vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-83527 is an authentication bypass vulnerability in Ivanti Sentry versions before R10.8.2, R10.7.3, and R10.6.4. It allows a remote unauthenticated attacker to gain administrative level access by exploiting an alternate path or channel. The vulnerability has a high severity with a CVSS score of 8.1.

CVE-2026-12648 is a high-severity vulnerability in Ivanti Neurons for ITSM prior to version 2026.2. It involves deserialization of untrusted data, which allows a remote authenticated attacker to execute arbitrary code on the server. The vulnerability requires low attack complexity and no user interaction, but does require the attacker to have some level of privileges. This flaw impacts confidentiality, integrity, and availability of the affected system.

CVE-2026-12650 is a critical deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-12651 is a high-severity vulnerability in Ivanti Neurons for ITSM prior to version 2026.2. It involves deserialization of untrusted data, which allows a remote authenticated attacker to execute arbitrary code on the server. The vulnerability requires authentication and has no user interaction needed. It impacts confidentiality, integrity, and availability of the affected system.

CVE-2026-12745 is a critical deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM versions before 2026.2. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected server, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-12744 is a critical vulnerability in Ivanti Neurons for ITSM before version 2026.2 involving deserialization of untrusted data. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected server, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-18851 is a high-severity vulnerability in Ivanti Endpoint Manager Mobile prior to versions 12.10.0.0, 12.9.0.2, and 12.8.0.4. It involves missing authorization controls that allow a remote authenticated attacker to escalate their privileges to admin.

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.