Ivant Known Exploited Vulnerabilities

Evidence-backed KEV intelligence for Ivant products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.

Total KEVs

In CISA KEV

Beyond CISA KEV

Sensor Observed

Virtual Patch Available

30 Ivant KEVs added all time (primary attestation date).

Attested CVEs

CVE	Product	Confidence	CISA KEV	Added
CVE-2025-0282 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons...	Connect Secure, Policy Secure, Neurons for ZTA gateways	Confirmed	In CISA	08 Jan 2025
CVE-2024-13159 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote...	Endpoint Manager	Confirmed	In CISA	10 Mar 2025
CVE-2024-13160 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote...	Endpoint Manager	Confirmed	In CISA	10 Mar 2025
CVE-2024-13161 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote...	Endpoint Manager	Confirmed	In CISA	10 Mar 2025
CVE-2025-22457 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA...	Connect Secure, Policy Secure, Neurons for ZTA gateways	Confirmed	In CISA	04 Apr 2025

CWE-287 — Improper Authentication 4
CWE-94 — Improper Control of Generation of Code ('Code Injection') 4
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 4
CWE-36 — Absolute Path Traversal 3
CWE-288 — Authentication Bypass Using an Alternate Path or Channel 2
CWE-121 — Stack-based Buffer Overflow 2
CWE-611 — Improper Restriction of XML External Entity Reference 2
CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection') 2