DaystoPatch

VendorsEdge, IT management

Ivanti

Ivanti makes Connect Secure and Policy Secure VPN gateways (formerly Pulse Secure), Endpoint Manager, Endpoint Manager Mobile (EPMM, formerly MobileIron) and IT service management software.

Response trend, 6 months
Not enough history
Open now
1 exploited, not fully fixed
Latest incident
13 Oct 2026
Incidents on record
9

Response to exploited bugs

82 range 71–92rank 5 of 10

Provisional 4 reviewed zero-days. Not enough yet for a firm grade.

Fixing privately reported bugs

64 range 53–75rank 19 of 20

Provisional Wide range: 53–75.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: B+ (82), provisional, from 4 reviewed zero-days in the last 36 months. Likely range 71 to 92.
  • First fix within a day for all 4 zero-days.
  • Every supported version fixed within a day for all 3 zero-days. 1 more has no public date for a fix to every version.
  • First advisory within a day for all 4 zero-days.
  • Fixing privately reported bugs: C (64), provisional. Median 126 days from private report to ZDI's public advisory (41 cases). 23 of 41 took longer than ZDI's 120-day deadline. ZDI published 4 before a fix was available. ZDI also does this when a vendor declines to fix.
  • 5 of 9 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.

Response to exploited bugs: sub-scores

  • Time to first advisory4 of 4 zero-days within a day
    83B+
    4 cases, low confidence, weight 20%
  • Time to first fix4 of 4 zero-days within a day
    83B+
    4 cases, low confidence, weight 40%
  • Time to fix all versions3 of 3 zero-days within a day
    83B+
    3 cases, low confidence, weight 30%
  • OpennessAdvisories available by RSS. 3 of 3 advisories said the bug was exploited. 3 of 4 fixed zero-days with a public fix date for every version.
    70B−
    8 cases, low confidence, weight 10%

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 126 days from private report to ZDI's public advisory (41 cases, 4 published without a fix)
    64C
    41 cases, low confidence, weight 100%

Response fingerprint

Median of 4 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.

Compressed time scale

Counts toward the response grade 4

  1. 7 May 2026Ivanti EPMM authenticated admin RCE exploited as a zero-day (May 2026)
  2. 29 Jan 2026Ivanti EPMM unauthenticated code injection zero-days (January 2026)
  3. 13 May 2025Ivanti EPMM API authentication bypass chained with RCE (May 2025 zero-days)
  4. 8 Jan 2025Ivanti Connect Secure unauthenticated stack overflow exploited as a zero-day (January 2025)
Not graded 5: n-days, unreviewed timelines and end-of-life products
  1. 13 Oct 2026Ivanti Connect Secure zero-day exploit chain (auth bypass + RCE, root privilege escalation)Not graded: n-day
  2. 9 Jun 2026Ivanti Sentry unauthenticated OS command injection (root RCE), exploited a day after the fixNot graded: n-day
  3. 10 Feb 2026Ivanti Endpoint Manager (EPM) authentication bypass leaking stored credentialsNot graded: n-day
  4. 3 Apr 2025Ivanti Connect Secure stack overflow exploited by China-nexus actor (fixed in Feb 2025, before public disclosure)Not graded: n-day
  5. 14 Jan 2025Ivanti Endpoint Manager absolute path traversal credential-coercion flaws (January 2025)Not graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

9 in 24 months, 2 with known ransomware use, 44% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
13 Oct 2026Ivanti Connect Secure zero-day exploit chain (auth bypass + RCE, root privilege escalation)CVE-2026-104935, CVE-2026-1113578.60hsame dayopenPartly fixedNot graded: n-day
9 Jun 2026Ivanti Sentry unauthenticated OS command injection (root RCE), exploited a day after the fixCVE-2026-10520, CVE-2026-1052310.00hsame daysame dayFixedNot graded: n-day
7 May 2026Ivanti EPMM authenticated admin RCE exploited as a zero-day (May 2026)CVE-2026-69737.20hsame daysame dayFixedCounts toward grade
10 Feb 2026Ivanti Endpoint Manager (EPM) authentication bypass leaking stored credentialsCVE-2026-16038.60hsame daysame dayFixedNot graded: n-day
29 Jan 2026Ivanti EPMM unauthenticated code injection zero-days (January 2026)CVE-2026-1281, CVE-2026-13409.80hsame daysame dayFixedCounts toward grade
13 May 2025Ivanti EPMM API authentication bypass chained with RCE (May 2025 zero-days)CVE-2025-4427, CVE-2025-44287.20hsame daysame dayFixedCounts toward grade
3 Apr 2025Ivanti Connect Secure stack overflow exploited by China-nexus actor (fixed in Feb 2025, before public disclosure)CVE-2025-224579.00hsame daynot datedFixedNot graded: n-day
14 Jan 2025Ivanti Endpoint Manager absolute path traversal credential-coercion flaws (January 2025)CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, CVE-2024-108119.80hsame daysame dayFixedNot graded: n-day
8 Jan 2025Ivanti Connect Secure unauthenticated stack overflow exploited as a zero-day (January 2025)CVE-2025-0282, CVE-2025-02839.0same daysame daynot datedFixedCounts toward grade

Private reports

Median 126 days, 56% over 120 days, 4 published unpatched

Bugs reported privately to Ivanti by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
12 May 2026ZDI-26-080, ZDI-26-308CVE-2026-1603, CVE-2026-8109Endpoint Manager168to publicationYes
12 Feb 2026ZDI-26-079CVE-2026-1602Endpoint Manager163to publicationYes
10 Dec 2025ZDI-25-1051, ZDI-25-1052CVE-2025-13661, CVE-2025-13662Endpoint Manager82to publicationYes
16 Oct 2025ZDI-25-935, ZDI-25-936CVE-2025-9713, CVE-2025-11623Endpoint Manager135to publicationNo, published unpatched
16 Oct 2025ZDI-25-040, ZDI-25-947CVE-2024-13163, CVE-2025-11622Endpoint Manager345to publicationNo, published unpatched
10 Oct 2025ZDI-25-937, ZDI-25-938, ZDI-25-939, ZDI-25-940, ZDI-25-941, ZDI-25-942, ZDI-25-943, ZDI-25-944, ZDI-25-952CVE-2025-9872, CVE-2025-62383, CVE-2025-62385, CVE-2025-62387, CVE-2025-62388, CVE-2025-62389, CVE-2025-62390, CVE-2025-62391, CVE-2025-62392Endpoint Manager127to publicationNo, published unpatched
7 Oct 2025ZDI-25-945, ZDI-25-946CVE-2025-62384, CVE-2025-62386Endpoint Manager102to publicationNo, published unpatched
30 Sep 2025ZDI-25-922CVE-2025-9712Endpoint Manager124to publicationYes
20 Aug 2025ZDI-25-856, ZDI-25-857CVE-2025-8296, CVE-2025-8297Avalanche62to publicationYes
9 Apr 2025ZDI-25-235CVE-2025-22461Endpoint Manager111to publicationYes
Show all 41 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
10 Mar 2025ZDI-24-1490, ZDI-24-1491, ZDI-24-1492, ZDI-24-1509, ZDI-24-1510, ZDI-25-031, ZDI-25-032, ZDI-25-033, ZDI-25-034, ZDI-25-035, ZDI-25-036, ZDI-25-037, ZDI-25-038, ZDI-25-039, ZDI-25-114CVE-2024-13158, CVE-2024-13164, CVE-2024-13165, CVE-2024-13166, CVE-2024-13167, CVE-2024-13168, CVE-2024-13169, CVE-2024-13170, CVE-2024-13171, CVE-2024-13172, CVE-2024-50319, CVE-2024-50320, CVE-2024-50321, CVE-2024-50329, CVE-2024-50330Avalanche; Endpoint Manager153to publicationYes
19 Jan 2025ZDI-25-041, ZDI-25-042, ZDI-25-043, ZDI-25-044CVE-2024-13162, CVE-2024-13179, CVE-2024-13180, CVE-2024-13181Endpoint Manager; Avalanche44to publicationYes
17 Dec 2024ZDI-24-1487, ZDI-24-1695CVE-2024-7571, CVE-2024-37373Secure Access Client; Avalanche158to publicationYes
13 Nov 2024ZDI-24-1488, ZDI-24-1489CVE-2024-50317, CVE-2024-50318Avalanche57to publicationYes
13 Nov 2024ZDI-24-1506, ZDI-24-1507, ZDI-24-1508CVE-2024-50326, CVE-2024-50327, CVE-2024-50328Endpoint Manager76to publicationYes
13 Nov 2024ZDI-24-1504, ZDI-24-1505CVE-2024-50323, CVE-2024-50324Endpoint Manager83to publicationYes
13 Nov 2024ZDI-24-1502CVE-2024-37376Endpoint Manager145to publicationYes
13 Nov 2024ZDI-24-1211, ZDI-24-1501, ZDI-24-1503CVE-2024-8191, CVE-2024-34787, CVE-2024-50322Endpoint Manager160to publicationYes
13 Nov 2024ZDI-24-1213, ZDI-24-1214, ZDI-24-1215, ZDI-24-1216, ZDI-24-1217, ZDI-24-1218, ZDI-24-1219, ZDI-24-1220, ZDI-24-1221, ZDI-24-1493, ZDI-24-1494, ZDI-24-1495, ZDI-24-1496, ZDI-24-1497, ZDI-24-1498, ZDI-24-1499, ZDI-24-1500CVE-2024-32839, CVE-2024-32840, CVE-2024-32841, CVE-2024-32842, CVE-2024-32843, CVE-2024-32844, CVE-2024-32845, CVE-2024-32846, CVE-2024-32847, CVE-2024-32848, CVE-2024-34779, CVE-2024-34781, CVE-2024-34782, CVE-2024-34783, CVE-2024-34784, CVE-2024-34785Endpoint Manager161to publicationYes
8 Oct 2024ZDI-24-1324, ZDI-24-1325, ZDI-24-1326, ZDI-24-1327CVE-2024-47008, CVE-2024-47009, CVE-2024-47010, CVE-2024-47011Avalanche174to publicationYes
12 Sep 2024ZDI-24-1223CVE-2024-29847Endpoint Manager134to publicationYes
11 Sep 2024ZDI-24-1151, ZDI-24-1212CVE-2024-37397, CVE-2024-37399Avalanche; Endpoint Manager75to publicationYes
11 Sep 2024ZDI-24-1222CVE-2024-8012Workspace Control139to publicationYes
15 Aug 2024ZDI-24-1150CVE-2024-38653Avalanche337to publicationYes
15 Aug 2024ZDI-24-1149CVE-2024-38652Avalanche394to publicationYes
24 May 2024ZDI-24-504CVE-2024-29848Avalanche30to publicationYes
24 May 2024ZDI-24-505, ZDI-24-506, ZDI-24-507, ZDI-24-508, ZDI-24-509, ZDI-24-510CVE-2024-29822, CVE-2024-29823, CVE-2024-29824, CVE-2024-29825, CVE-2024-29826, CVE-2024-29827Endpoint Manager51to publicationYes
24 May 2024ZDI-24-511, ZDI-24-512, ZDI-24-513, ZDI-24-514CVE-2024-29828, CVE-2024-29829, CVE-2024-29830, CVE-2024-29846Endpoint Manager58to publicationYes
23 Apr 2024ZDI-24-390CVE-2024-25000Avalanche104to publicationYes
23 Apr 2024ZDI-24-388, ZDI-24-389, ZDI-24-391, ZDI-24-392, ZDI-24-393, ZDI-24-394CVE-2024-24998, CVE-2024-24999, CVE-2024-27975, CVE-2024-27976, CVE-2024-27977, CVE-2024-27978Avalanche105to publicationYes
23 Apr 2024ZDI-24-386, ZDI-24-387CVE-2024-24996, CVE-2024-24997Avalanche123to publicationYes
23 Apr 2024ZDI-24-377, ZDI-24-378, ZDI-24-379, ZDI-24-380, ZDI-24-381, ZDI-24-382, ZDI-24-383, ZDI-24-384, ZDI-24-385CVE-2024-23532, CVE-2024-23533, CVE-2024-23534, CVE-2024-23535, CVE-2024-24991, CVE-2024-24992, CVE-2024-24993, CVE-2024-24994, CVE-2024-24995Avalanche132to publicationYes
23 Apr 2024ZDI-24-376, ZDI-24-395CVE-2024-23531, CVE-2024-27984Avalanche139to publicationYes
23 Apr 2024ZDI-24-370, ZDI-24-371, ZDI-24-372, ZDI-24-373, ZDI-24-374, ZDI-24-375CVE-2024-22061, CVE-2024-23526, CVE-2024-23527, CVE-2024-23528, CVE-2024-23529, CVE-2024-23530Avalanche147to publicationYes
11 Jan 2024ZDI-24-071CVE-2023-46804Avalanche56to publicationYes
11 Jan 2024ZDI-24-062, ZDI-24-063, ZDI-24-064, ZDI-24-065, ZDI-24-066, ZDI-24-067, ZDI-24-068, ZDI-24-069, ZDI-24-070CVE-2023-46220, CVE-2023-46221, CVE-2023-46222, CVE-2023-46223, CVE-2023-46224, CVE-2023-46225, CVE-2023-46257, CVE-2023-46258, CVE-2023-46803Avalanche63to publicationYes
11 Jan 2024ZDI-24-059, ZDI-24-060, ZDI-24-061CVE-2023-46259, CVE-2023-46260, CVE-2023-46261Avalanche91to publicationYes
11 Jan 2024ZDI-24-057, ZDI-24-058CVE-2021-22962, CVE-2023-46266Avalanche106to publicationYes
11 Jan 2024ZDI-24-056CVE-2023-46263Avalanche126to publicationYes
11 Jan 2024ZDI-24-055CVE-2023-46264Avalanche142to publicationYes
11 Jan 2024ZDI-24-053, ZDI-24-054CVE-2023-46262, CVE-2023-46265Avalanche184to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Show as a table
MonthScoreGrade
Nov 2025–NR
Dec 2025–NR
Jan 202682B+
Feb 202681B+
Mar 202681B+
Apr 202681B+
May 202683B+
Jun 202683B+
Jul 202682B+
Aug 202682B+
Sep 202682B+
Oct 202682B+

Channels

Get Ivanti's own alerts

What we watch

  • RSSIvanti blog: Security Advisory topic RSS

See sources and health for when each was last read.