CISA KEV + NVD
Ivanti flaws exploited in the wild
15 Ivanti vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
Includes the Pulse Secure entries: Pulse Connect Secure became Ivanti Connect Secure.
In numbers
- 15 exploited flaws, listed from 3 Nov 2021 to 13 Oct 2026
- 8 used in ransomware campaigns
- 5 scored critical by NVD
- 0 days: median gap between NVD publication and the KEV listing, leaving out the 8 listed on the catalog’s first day; 6 were listed within a week
All exploited Ivanti flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Connect Secure | 13 Oct 2026 | 13 Oct 2026same day or before NVD | 8.6 High | Vendor |
| CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | Connect Secure, Policy Secure, and ZTA Gateways | 3 Apr 2025 | 4 Apr 20251 day laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | Connect Secure, Policy Secure, and ZTA Gateways | 8 Jan 2025 | 8 Jan 2025same day or before NVDUsed in ransomware | 9.0 Critical | Vendor |
| CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | Connect Secure, Policy Secure, and Neurons | 31 Jan 2024 | 31 Jan 2024same day or before NVDUsed in ransomware | 8.2 High | Vendor |
| CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | Connect Secure and Policy Secure | 12 Jan 2024 | 10 Jan 2024same day or before NVDUsed in ransomware | 9.1 Critical | Vendor |
| CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | Connect Secure and Policy Secure | 12 Jan 2024 | 10 Jan 2024same day or before NVDUsed in ransomware | 8.2 High | Vendor |
| CVE-2020-8218Pulse Connect Secure Code Injection Vulnerability | Pulse Connect Secure | 30 Jul 2020 | 7 Mar 2022585 days later | 7.2 High | — |
| CVE-2021-22900Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | Pulse Connect Secure | 27 May 2021 | 3 Nov 2021160 days later | 7.2 High | — |
| CVE-2021-22899Ivanti Pulse Connect Secure Command Injection Vulnerability | Pulse Connect Secure | 27 May 2021 | 3 Nov 2021160 days later | 8.8 High | — |
| CVE-2021-22894Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | Pulse Connect Secure | 27 May 2021 | 3 Nov 2021160 days later | 8.8 High | — |
| CVE-2021-22893Ivanti Pulse Connect Secure Use-After-Free Vulnerability | Pulse Connect Secure | 23 Apr 2021 | 3 Nov 2021194 days laterUsed in ransomware | 10.0 Critical | — |
| CVE-2020-8260Ivanti Pulse Connect Secure Code Execution Vulnerability | Pulse Connect Secure | 28 Oct 2020 | 3 Nov 2021371 days later | 7.2 High | — |
| CVE-2020-8243Ivanti Pulse Connect Secure Code Execution Vulnerability | Pulse Connect Secure | 30 Sep 2020 | 3 Nov 2021399 days later | 7.2 High | — |
| CVE-2019-11539Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | Pulse Connect Secure and Pulse Policy Secure | 26 Apr 2019 | 3 Nov 2021922 days laterUsed in ransomware | 7.2 High | — |
| CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | Pulse Connect Secure | 8 May 2019 | 3 Nov 2021910 days laterUsed in ransomware | 10.0 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.