Ivanti: vulnerabilidades explotadas
- 36vulnerabilidades explotadas
- 12usado por ransomware
- 13 oct 2026la última añadida
- Endpoint Manager Mobile (EPMM) 7
- Pulse Connect Secure 7
- Endpoint Manager (EPM) 4
- Cloud Services Appliance (CSA) 3
- Sentry 2
- Connect Secure, Policy Secure, and ZTA Gateways 2
- Connect Secure and Policy Secure 2
- Connect Secure 1
- Endpoint Manager (EPM) 1
- Virtual Traffic Manager 1
- Cloud Services Appliance 1
- Endpoint Manager Cloud Service Appliance (EPM CSA) 1
- Connect Secure, Policy Secure, and Neurons 1
- Endpoint Manager Mobile (EPMM) and MobileIron Core 1
- MobileIron Multiple Products 1
- Pulse Connect Secure and Pulse Policy Secure 1
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 13 oct 2026 | Authentication Bypass by Spoofing | Connect Secure | Alto 8,6 | 87% |
| 11 jun 2026 | OS Command Injection | Sentry | Crítica 10,0 | 99,9% |
| 7 may 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | Alto 7,2 | 34% |
| 8 abr 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Crítica 9,8 | 99% |
| 9 mar 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | Alto 8,6 | 88% |
| 29 ene 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Crítica 9,8 | 99% |
| 19 may 2025 | Code Injection | Endpoint Manager Mobile (EPMM) | Alto 7,2 | 88% |
| 19 may 2025 | Authentication Bypass | Endpoint Manager Mobile (EPMM) | Media 5,3 | 99,9% |
| 4 abr 2025 | Stack-Based Buffer Overflow | Connect Secure, Policy Secure, and ZTA Gateways | Crítica 9,0 | >99,9% |
| 10 mar 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Crítica 9,8 | 90% |
| 10 mar 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Crítica 9,8 | 91% |
| 10 mar 2025 | Absolute Path Traversal | Endpoint Manager (EPM) | Crítica 9,8 | >99,9% |
| 8 ene 2025 | Stack-Based Buffer Overflow | Connect Secure, Policy Secure, and ZTA Gateways | Crítica 9,0 | >99,9% |
| 9 oct 2024 | OS Command Injection | Cloud Services Appliance (CSA) | Alto 7,2 | 58% |
| 9 oct 2024 | SQL Injection | Cloud Services Appliance (CSA) | Media 6,5 | 44% |
| 2 oct 2024 | SQL Injection | Endpoint Manager (EPM) | Crítica 9,6 | 99,9% |
| 24 sept 2024 | Authentication Bypass | Virtual Traffic Manager | Crítica 9,8 | >99,9% |
| 19 sept 2024 | Path Traversal | Cloud Services Appliance (CSA) | Crítica 9,4 | 99% |
| 13 sept 2024 | OS Command Injection | Cloud Services Appliance | Alto 7,2 | 89% |
| 25 mar 2024 | Code Injection Vulnerability | Endpoint Manager Cloud Service Appliance (EPM CSA) | Crítica 9,8 | 99,1% |
| 31 ene 2024 | Server-Side Request Forgery (SSRF) | Connect Secure, Policy Secure, and Neurons | Alto 8,2 | >99,9% |
| 18 ene 2024 | Authentication Bypass | Endpoint Manager Mobile (EPMM) and MobileIron Core | Crítica 10,0 | >99,9% |
| 10 ene 2024 | Command Injection | Connect Secure and Policy Secure | Crítica 9,1 | >99,9% |
| 10 ene 2024 | Authentication Bypass | Connect Secure and Policy Secure | Alto 8,2 | >99,9% |
| 22 ago 2023 | Authentication Bypass | Sentry | Crítica 9,8 | >99,9% |
| 31 jul 2023 | Path Traversal | Endpoint Manager Mobile (EPMM) | Alto 7,2 | 64% |
| 25 jul 2023 | Endpoint Manager Mobile Authentication Bypass | Endpoint Manager Mobile (EPMM) | Crítica 10,0 | >99,9% |
| 3 nov 2021 | Unrestricted File Upload | Pulse Connect Secure | Alto 7,2 | 14% |
| 3 nov 2021 | Command Injection | Pulse Connect Secure | Alto 8,8 | 23% |
| 3 nov 2021 | Collaboration Suite Buffer Overflow | Pulse Connect Secure | Alto 8,8 | 41% |
| 3 nov 2021 | Use-After-Free | Pulse Connect Secure | Crítica 10,0 | 47% |
| 3 nov 2021 | Code Execution | Pulse Connect Secure | Alto 7,2 | 96% |
| 3 nov 2021 | Code Execution | Pulse Connect Secure | Alto 7,2 | 91% |
| 3 nov 2021 | Remote Code Execution | MobileIron Multiple Products | Crítica 9,8 | 99,7% |
| 3 nov 2021 | Pulse Connect Secure and Policy Secure Command Injection | Pulse Connect Secure and Pulse Policy Secure | Alto 8,0 | 99% |
| 3 nov 2021 | Arbitrary File Read | Pulse Connect Secure | Crítica 9,9 | >99,9% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.