The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
30 Oct 2026 Ivanti Connect Secure Security flaw
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.1.3
- CISA due date
- 13 Nov 2026 (still open)
- Weakness
- CWE-340
30 Oct 2026 Ivanti Connect Secure Authentication bypass
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.1.3
- CISA due date
- 2 Nov 2026
- Weakness
- CWE-306, CWE-862, CWE-345
13 Oct 2026 Ivanti Connect Secure Authentication bypass
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti connect secure 25.1.3.0, ivanti connect secure 25.1.1.2
- CISA due date
- 16 Oct 2026
- Weakness
- CWE-290
11 Jun 2026 Ivanti Sentry Command injection
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti standalone sentry 10.6.2, ivanti standalone sentry 10.5.2
- CISA due date
- 14 Jun 2026
- Weakness
- CWE-78
7 May 2026 Ivanti Endpoint Manager Mobile (EPMM) Input validation flaw
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager mobile 12.6.1.1
- CISA due date
- 10 May 2026
- Weakness
- CWE-20
8 Apr 2026 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 11 Apr 2026
- Weakness
- CWE-94
9 Mar 2026 Ivanti Endpoint Manager (EPM) Authentication bypass
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2024
- CISA due date
- 23 Mar 2026
- Weakness
- CWE-288
29 Jan 2026 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 1 Feb 2026
- Weakness
- CWE-94
19 May 2025 Ivanti Endpoint Manager Mobile (EPMM) Remote code execution
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager mobile 12.4.0.2, ivanti endpoint manager mobile 12.3.0.2, ivanti endpoint manager mobile 11.12.0.5
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-94
19 May 2025 Ivanti Endpoint Manager Mobile (EPMM) Authentication bypass
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager mobile 12.4.0.2, ivanti endpoint manager mobile 12.3.0.2, ivanti endpoint manager mobile 11.12.0.5
- CISA due date
- 9 Jun 2025
- Weakness
- CWE-288
4 Apr 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below.
- Fixed in (NVD)
- ivanti zero trust access gateway 22.8, ivanti connect secure 22.7, ivanti policy secure 22.7
- CISA due date
- 11 Apr 2025
- Weakness
- CWE-121
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
10 Mar 2025 Ivanti Endpoint Manager (EPM) Path traversal
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 31 Mar 2025
- Weakness
- CWE-36
8 Jan 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
- CISA due date
- 15 Jan 2025
- Weakness
- CWE-121
9 Oct 2024 Ivanti Cloud Services Appliance (CSA) Command injection
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
- What to do
- As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
- Fixed in (NVD)
- ivanti endpoint manager cloud services appliance 5.0.2
- CISA due date
- 30 Oct 2024
- Weakness
- CWE-77
9 Oct 2024 Ivanti Cloud Services Appliance (CSA) SQL injection
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- What to do
- As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
- Fixed in (NVD)
- ivanti endpoint manager cloud services appliance 5.0.2
- CISA due date
- 30 Oct 2024
- Weakness
- CWE-89
2 Oct 2024 Ivanti Endpoint Manager (EPM) SQL injection
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 23 Oct 2024
- Weakness
- CWE-89
24 Sep 2024 Ivanti Virtual Traffic Manager Authentication bypass
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 15 Oct 2024
- Weakness
- CWE-287, CWE-303
19 Sep 2024 Ivanti Cloud Services Appliance (CSA) Path traversal
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
- What to do
- As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
- CISA due date
- 10 Oct 2024
- Weakness
- CWE-22
13 Sep 2024 Ivanti Cloud Services Appliance Command injection
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
- What to do
- As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
- CISA due date
- 4 Oct 2024
- Weakness
- CWE-78
25 Mar 2024 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Remote code execution
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-94
31 Jan 2024 Ivanti Connect Secure, Policy Secure, and Neurons Server-side request forgery
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 2 Feb 2024
- Weakness
- CWE-918
18 Jan 2024 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication bypass
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager mobile 11.11.0
- CISA due date
- 8 Feb 2024
- Weakness
- CWE-287
10 Jan 2024 Ivanti Connect Secure and Policy Secure Command injection
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 22 Jan 2024
- Weakness
- CWE-77
10 Jan 2024 Ivanti Connect Secure and Policy Secure Authentication bypass
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 22 Jan 2024
- Weakness
- CWE-287
22 Aug 2023 Ivanti Sentry Access control flaw
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Sep 2023
- Weakness
- CWE-863
31 Jul 2023 Ivanti Endpoint Manager Mobile (EPMM) Path traversal
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager mobile 11.10.0.3, ivanti endpoint manager mobile 11.9.1.2, ivanti endpoint manager mobile 11.8.1.2
- CISA due date
- 21 Aug 2023
- Weakness
- CWE-22
25 Jul 2023 Ivanti Endpoint Manager Mobile (EPMM) Authentication bypass
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager mobile 11.10.0.2, ivanti endpoint manager mobile 11.9.1.1, ivanti endpoint manager mobile 11.8.1.1
- CISA due date
- 15 Aug 2023
- Weakness
- CWE-287
7 Mar 2022 Pulse Secure Pulse Connect Secure Remote code execution
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti Pulse Connect Secure Remote code execution
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti Pulse Connect Secure Command injection
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-77
3 Nov 2021 Ivanti Pulse Connect Secure Remote code execution
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti Pulse Connect Secure Authentication bypass
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-287
On Hacker News
CVE-2021-22893 exploit honey"POC"3 Nov 2021 Ivanti Pulse Connect Secure Malicious file upload
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-434
3 Nov 2021 Ivanti Pulse Connect Secure Remote code execution
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
3 Nov 2021 Ivanti MobileIron Multiple Products Security flaw
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mobileiron core 10.6.0.1, mobileiron enterprise connector 10.6.0.1, mobileiron core 10.5.2.1, mobileiron enterprise connector 10.5.2.1, mobileiron core 10.5.1.1 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-706
3 Nov 2021 Ivanti Pulse Connect Secure and Pulse Policy Secure Command injection
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Ivanti Pulse Connect Secure Path traversal
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.