https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Ivanti.Sun, 26 Jul 2026 22:32:51 GMThttps://darkreading.com/cybersecurity-operations/remediating-vulnerabilities-llms-ivanti-automationcst-2873Ivanti's Chief Security Officer reports that large language models show promise in early testing for vulnerability remediation automation, though questions persist about cost-effectiveness and the need for human oversight. The company is exploring frontier models to streamline the patching process, balancing efficiency gains with practical deployment constraints.Mon, 20 Jul 2026 20:26:56 GMThttps://securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenowcst-2576ServiceNow, Fortinet, and Ivanti each released patches for security vulnerabilities affecting their platforms. A critical vulnerability in ServiceNow's AI platform could allow remote attackers to execute arbitrary code.Wed, 15 Jul 2026 11:02:57 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5099539-extended-security-updatecst-2513Microsoft released Windows 10 KB5099539, an extended security update containing July 2026 Patch Tuesday fixes for 570 vulnerabilities and additional security patches. This update addresses a substantial volume of identified flaws across the Windows 10 platform.Tue, 14 Jul 2026 18:49:28 GMThttps://rapid7.com/blog/post/etr-cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentrycst-380Ivanti released security advisories for two critical vulnerabilities in Ivanti Sentry on June 9, 2026: CVE-2026-10520 (CVSS 10.0), an OS command injection enabling unauthenticated remote code execution as root, and CVE-2026-10523 (CVSS 9.9), an authentication bypass allowing creation of arbitrary administrative accounts. A public proof-of-concept exploit for CVE-2026-10520 was published on June 10, and the vulnerability was added to CISA's Known Exploited Vulnerabilities list on June 11 with evidence of active exploitation in the wild.Wed, 10 Jun 2026 10:21:07 GMThttps://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520cst-559Ivanti released an advisory for two critical vulnerabilities in its Sentry product: CVE-2026-10520, a pre-authenticated OS command injection flaw allowing unauthenticated remote code execution with CVSS 10.0, and CVE-2026-10523, an authentication bypass enabling creation of arbitrary administrative accounts. Both vulnerabilities affect Ivanti Sentry versions before R10.5.2, R10.6.2, and R10.7.1.Wed, 10 Jun 2026 00:52:20 GMThttps://recordedfuture.com/blog/may-2026-cve-landscapecst-1953In May 2026, Insikt Group identified 41 high-impact vulnerabilities requiring prioritized remediation, representing an 11% increase from April. These vulnerabilities affected 20 vendors, with 21 included in CISA's Known Exploited Vulnerabilities catalog, 19 detected via honeypot data, and one reported by a vendor. Notably, 12 vulnerabilities enabled remote code execution, public proof-of-concept exploits were available for 32 of them, and five were first disclosed between 2008 and 2010, demonstrating continued exploitation of long-standing weaknesses.Mon, 08 Jun 2026 00:00:00 GMThttps://recordedfuture.com/blog/march-2026-cve-landscapecst-1981Insikt Group identified 31 high-impact vulnerabilities actively exploited in March 2026, with 29 rated as very critical. The affected products span major vendors including Cisco, Microsoft, Google, ConnectWise, Citrix, and others, with Microsoft and Apple accounting for approximately 32% of the total. Notable findings include the Interlock ransomware group exploiting a Cisco Firewall Management Center zero-day, the continued exploitation of a nine-year-old Hikvision vulnerability, and public proof-of-concept exploits available for 10 of the 31 vulnerabilities.Mon, 13 Apr 2026 00:00:00 GMThttps://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chainscst-563watchTowr Labs discovered four chained vulnerabilities in BMC FootPrints ITSM solution, including authentication bypass, server-side request forgery, and deserialization flaws that enable pre-authenticated remote code execution. The vulnerabilities affect BMC FootPrints versions 20.20.02 through 20.24.01.001, and disclosure to BMC began in June 2025. ITSM solutions like FootPrints are high-value targets because they manage IT inventory, configuration data, and incident information that organized threat actors leverage for ransomware campaigns.Wed, 18 Mar 2026 10:02:49 GMThttps://greynoise.io/blog/active-ivanti-exploitationcst-1860GreyNoise detected active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, with 83% of observed attacks originating from a single IP address hosted on bulletproof infrastructure. This IP does not appear on most public indicator of compromise (IOC) lists, suggesting gaps in threat intelligence sharing.Tue, 10 Feb 2026 00:00:00 GMThttps://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340cst-566Ivanti released patches for two pre-authentication remote code execution vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Endpoint Manager Mobile (EPMM), an enterprise mobility management platform used to control corporate mobile devices. The vulnerabilities are actively exploited in the wild and have been added to CISA's Known Exploited Vulnerabilities list. Permanent patches are not available until Q1 2026; customers are currently receiving temporary RPM patches that must be reapplied after system updates to remain effective.Fri, 30 Jan 2026 16:15:16 GMThttps://greynoise.io/blog/ivanti-epmm-zero-days-reconnaissance-exploitationcst-1902Two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (CVE-2025-4427 and CVE-2025-4428) are under active exploitation following increased reconnaissance scanning activity. When chained together, these flaws allow unauthenticated remote code execution on affected systems.Fri, 16 May 2025 00:00:00 GMThttps://greynoise.io/blog/surge-ivanti-connect-secure-scanning-activitycst-1905GreyNoise detected a nine-fold increase in suspicious scanning activity targeting Ivanti Connect Secure and Ivanti Pulse Secure VPN systems, with more than 230 unique IP addresses conducting probes against these endpoints. The surge in reconnaissance activity suggests possible coordinated preparation for future exploitation attacks.Wed, 23 Apr 2025 00:00:00 GMThttps://greynoise.io/blog/heightened-in-the-wild-activity-key-technologiescst-1908On March 28, GreyNoise detected a sharp increase in wild exploitation activity targeting multiple vendors including SonicWall, Zoho, Zyxel, F5, Linksys, and Ivanti. The affected technologies span both edge systems and internal management tools, suggesting a broad attack campaign.Tue, 01 Apr 2025 00:00:00 GMThttps://wiz.io/blog/cve-2025-0282-and-cve-2025-0283-critical-ivanti-0days-exploited-in-the-wildcst-1507Ivanti has disclosed two critical remote code execution (RCE) vulnerabilities in Connect Secure, identified as CVE-2025-0282 and CVE-2025-0283, that are being actively exploited in the wild. Organizations using these products require immediate patching to prevent compromise.Thu, 09 Jan 2025 14:23:44 GMT