PS
Product
Policy Secure
On CISA KEVExploited in the wildRansomware-linked
77
CVEs
8
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 36Medium 31Low 2
Watch
Add Policy Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-22457 RansomwareIn wildKEV | 9.8 | Apr 3 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-21887 RansomwareIn wildKEV | 9.1 | Jan 12 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Affected: 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +31 more |
| CVE-2025-0282 RansomwareIn wildKEV | 9.0 | Jan 8 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: 22.7R1 through 22.7R1.2 |
| CVE-2024-21893 RansomwareIn wildKEV | 8.2 | Jan 31 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2023-46805 RansomwareIn wildKEV | 8.2 | Jan 12 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Affected: 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +31 more |
| CVE-2020-8243 In wildKEV | 7.2 | Sep 29 | Ivanti Pulse Connect Secure Code Execution Vulnerability Affected: through 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +8 more |
| CVE-2020-8218 In wildKEV | 7.2 | Jul 30 | Pulse Connect Secure Code Injection Vulnerability Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2019-11539 RansomwareIn wildKEV | 7.2 | Apr 26 | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability Affected: 9.0; 9.0; 9.0; 9.0; 9.0 |
| CVE-2024-21894 | 9.8 | Apr 4 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +26 more |
| CVE-2024-39712 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-39711 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-39710 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-38656 | 9.1 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2025-55145 | 8.9 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-55147 | 8.8 | Sep 9 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-55142 | 8.8 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-55141 | 8.8 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2024-9420 | 8.8 | Nov 12 | A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-37404 | 8.8 | Oct 18 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker… Affected: before 22.7; 22.7; 22.7 |
| CVE-2024-21888 | 8.8 | Jan 31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2019-11509 | 8.8 | Jun 3 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0 |
| CVE-2024-22024 | 8.3 | Feb 13 | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker… Affected: 22.5 |
| CVE-2024-22053 | 8.2 | Apr 4 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +26 more |
| CVE-2020-8206 | 8.1 | Jul 30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-39709 | 7.8 | Nov 13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow… Affected: before 9.1; 22.1 before 22.7; 9.1; 22.7 |
| CVE-2024-47906 | 7.8 | Nov 12 | Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx)… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7 |
| CVE-2025-55148 | 7.6 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-5462 | 7.5 | Aug 12 | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2025-5456 | 7.5 | Aug 12 | A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2024-37401 | 7.5 | Dec 12 | An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-37377 | 7.5 | Dec 12 | A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-8495 | 7.5 | Nov 12 | A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to cause a… Affected: before 22.7; 22.7; 22.7 |
| CVE-2024-22052 | 7.5 | Apr 4 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +26 more |
| CVE-2022-35258 | 7.5 | Dec 5 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4,… Affected: before 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +20 more |
| CVE-2022-35254 | 7.5 | Dec 5 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4,… Affected: before 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +20 more |
| CVE-2024-10644 | 7.2 | Feb 11 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-11634 | 7.2 | Dec 10 | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-38655 | 7.2 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-11006 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7 |
| CVE-2024-11005 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7 |
| CVE-2024-11007 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 22.7; 22.7; 22.7 |
| CVE-2020-15352 | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2020-8219 | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-0283 | 7.0 | Jan 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version… Affected: 22.7R1.2 |
| CVE-2025-55139 | 6.8 | Sep 9 | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2020-8222 | 6.8 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2020-8220 | 6.5 | Jul 30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-55143 | 6.1 | Sep 9 | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2024-13830 | 6.1 | Feb 11 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-11004 | 6.1 | Nov 12 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7 |