CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22893 RansomwareIn wildKEV | 10.0 | Apr 23 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability Affected: PCS 9.0R3 or above, PCS 9.1R1 and above |
| CVE-2019-11510 RansomwareIn wildKEV | 10.0 | May 8 | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability Affected: 8.2; 8.2; 8.2; 8.2; 8.2; 8.2; +31 more |
| CVE-2025-22457 RansomwareIn wildKEV | 9.8 | Apr 3 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-21887 RansomwareIn wildKEV | 9.1 | Jan 12 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Affected: 9.1R18 through 9.1R18; 22.6R2 through 22.6R2 |
| CVE-2025-0282 RansomwareIn wildKEV | 9.0 | Jan 8 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: 22.7R2 through 22.7R2.4 |
| CVE-2021-22899 In wildKEV | 8.8 | May 27 | Ivanti Pulse Connect Secure Command Injection Vulnerability Affected: Fixed in 9.1R11.4 |
| CVE-2021-22894 In wildKEV | 8.8 | May 27 | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability Affected: Fixed version 9.1R11.4 |
| CVE-2026-104935 In wildKEV | 8.6 | Oct 13 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Affected: 25.1.0.0 before 25.1.1.2; 25.1.2.0 before 25.1.3.0; 22.8; 22.8; 22.8; 22.8; +1 more |
| CVE-2024-21893 RansomwareIn wildKEV | 8.2 | Jan 31 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Affected: 9.1R18 through 9.1R18; 22.6R2 through 22.6R2 |
| CVE-2023-46805 RansomwareIn wildKEV | 8.2 | Jan 12 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Affected: 9.1R18 through 9.1R18; 22.6R2 through 22.6R2 |
| CVE-2021-22900 In wildKEV | 7.2 | May 27 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2020-8260 In wildKEV | 7.2 | Oct 28 | Ivanti Pulse Connect Secure Code Execution Vulnerability Affected: through 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +10 more |
| CVE-2020-8243 In wildKEV | 7.2 | Sep 29 | Ivanti Pulse Connect Secure Code Execution Vulnerability Affected: through 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +8 more |
| CVE-2020-8218 In wildKEV | 7.2 | Jul 30 | Pulse Connect Secure Code Injection Vulnerability Affected: Fixed in 9.1R8 |
| CVE-2019-11539 RansomwareIn wildKEV | 7.2 | Apr 26 | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +34 more |
| CVE-2016-4787 | 10.0 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in… Affected: 8.0; 8.2; 8.1 |
| CVE-2024-21894 | 9.8 | Apr 4 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2018-20813 | 9.8 | Jun 28 | An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 Affected: 8.3 |
| CVE-2018-20810 | 9.8 | Jun 28 | Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure… Affected: 8.3 |
| CVE-2019-11540 | 9.8 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an… Affected: 8.3 |
| CVE-2018-6320 | 9.8 | Sep 6 | A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before… Affected: 8.1 |
| CVE-2024-39712 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-39711 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-39710 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-38656 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2025-55145 | 8.9 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-55147 | 8.8 | Sep 9 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-55142 | 8.8 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-55141 | 8.8 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-22467 | 8.8 | Feb 11 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution Affected: through 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +7 more |
| CVE-2024-9844 | 8.8 | Dec 10 | Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-9420 | 8.8 | Nov 12 | A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve… Affected: before 9.1; 21.9 before 22.7; 9.1; 9.1; 9.1; 9.1; +34 more |
| CVE-2024-37404 | 8.8 | Oct 18 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker… Affected: before 9.1; 22.3 before 22.7; 9.1; 9.1; 9.1; 9.1; +34 more |
| CVE-2024-21888 | 8.8 | Jan 31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2021-22908 | 8.8 | May 27 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +19 more |
| CVE-2019-11509 | 8.8 | Jun 3 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +34 more |
| CVE-2017-11455 | 8.8 | Aug 29 | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote… Affected: 8.1 |
| CVE-2016-4791 | 8.6 | May 26 | The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to… Affected: 8.1; 8.2; 8.0 |
| CVE-2024-22024 | 8.3 | Feb 13 | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker… Affected: 9.1; 9.1; 9.1; 22.4; 22.5; 22.5 |
| CVE-2024-22053 | 8.2 | Apr 4 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2020-8206 | 8.1 | Jul 30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2019-11213 | 8.1 | Apr 12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end… Affected: 9.0r1 before 9.0r3 |
| CVE-2024-39709 | 7.8 | Nov 13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow… Affected: before 9.1; 21.9 before 22.6; 9.1; 22.6; 22.6 |
| CVE-2024-47906 | 7.8 | Nov 12 | Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx)… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2023-41720 | 7.8 | Dec 14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can escalate their… Affected: 22.1; 22.1; 22.2; 22.2; 22.3; 22.4; +6 more |
| CVE-2019-11538 | 7.7 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could allow an… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +34 more |
| CVE-2025-55148 | 7.6 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-5462 | 7.5 | Aug 12 | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5456 | 7.5 | Aug 12 | A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2024-37401 | 7.5 | Dec 12 | An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |