Vendor hub
Ivanti remote access and endpoint management products.
UTA0576 chains three Ivanti Connect Secure zero-days for unauthenticated root on VPN appliances, then steals AD credentials. All three in CISA KEV.
Updated 2026-11-09
| CVE | Product | Added to KEV | Status | Dossier |
|---|---|---|---|---|
| CVE-2026-111357 | Ivanti Connect Secure | 2026-10-30 | Active exploitation | Chain dossier → |
| CVE-2026-118527 | Ivanti Connect Secure | 2026-10-30 | Active exploitation | Chain dossier → |
| CVE-2026-104935 | Ivanti Connect Secure | 2026-10-13 | Active exploitation | Chain dossier → |
| CVE-2026-10520 | Ivanti Sentry | 2026-06-11 | Active exploitation | Planned |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-05-07 | Active exploitation | Planned |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-04-08 | Active exploitation | Planned |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) | 2026-03-09 | Active exploitation | Planned |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-01-29 | Active exploitation | Planned |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | Active exploitation | Planned |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | Active exploitation | Planned |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 2025-04-04 | Active exploitation | Planned |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | 2025-03-10 | Active exploitation | Planned |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | 2025-03-10 | Active exploitation | Planned |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | 2025-03-10 | Active exploitation | Planned |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 2025-01-08 | Active exploitation | Planned |
| CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) | 2024-10-09 | Active exploitation | Planned |
| CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) | 2024-10-09 | Active exploitation | Planned |
| CVE-2024-29824 | Ivanti Endpoint Manager (EPM) | 2024-10-02 | Active exploitation | Planned |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager | 2024-09-24 | Active exploitation | Planned |
| CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) | 2024-09-19 | Active exploitation | Planned |
| CVE-2024-8190 | Ivanti Cloud Services Appliance | 2024-09-13 | Active exploitation | Planned |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | 2024-03-25 | Active exploitation | Planned |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | 2024-01-31 | Active exploitation | Planned |
| CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core | 2024-01-18 | Active exploitation | Planned |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | 2024-01-10 | Active exploitation | Planned |