CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Ivanti Endpoint Manager (EPM) Authentication Bypass and Credential Leak Vulnerability (CVE-2026-1603) Urgent Security Advisory
[Affected Scope] Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5
[Impact] A remote unauthenticated attacker can bypass authentication to leak specific stored credential data, potentially leading to full infrastructure compromise
[Mitigation] Immediately upgrade Ivanti EPM to version 2024 SU5 or later, and restrict external access to the management console
Ivanti Endpoint Manager (EPM) Absolute Path Traversal and Information Disclosure Vulnerability (CVE-2024-13161) Security Advisory
[Affected Scope] Ivanti EPM versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update
[Impact] Remote unauthenticated attackers can exploit absolute path traversal to leak highly sensitive system information
[Mitigation] Immediately apply the official Ivanti security updates and restrict access to the EPM management interfaces
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (CVE-2024-13159) Security Advisory
[Affected Scope] Ivanti EPM 2024 prior to the January 2025 Security Update, and EPM 2022 SU6 prior to the January 2025 Security Update
[Impact] A remote unauthenticated attacker can exploit an absolute path traversal vulnerability to leak highly sensitive system information and credentials
[Mitigation] Immediately apply the official Ivanti January 2025 Security Update and restrict access to the EPM management console
Ivanti Endpoint Manager (EPM) Core Server Unauthenticated Remote Code Execution Vulnerability Advisory (CVE-2024-29824)
[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)
[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges
[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server