Ivanti
CompanyIvanti is an IT software company headquartered in South Jordan, Utah, United States. It produces software for IT Security, IT Service Management (ITSM), IT Asset Management (ITAM), Unified Endpoint Management (UEM), Identity Management, Patch Management and supply chain management. It was formed in January 2017 with the merger of LANDESK and HEAT Software, and later acquired Cherwell Software. The company became more widely known after security incidents related to the VPN hardware it sells.
From Wikipedia, licensed under CC BY-SA 4.0. Shown as published there.
Facts
- Country
- United StatesSource: Wikidata
- Founded
- 1985Source: Wikidata
- Headquarters
- South JordanSource: Wikidata
- Official website
- www.ivanti.comSource: Wikidata
- Wikipedia
- Read on WikipediaSource: Wikidata
Vulnerabilities
4 CVEs in our records, 2 known exploited (on CISA's KEV list).
- CVE-2026-111357 Exploited added to KEV 30 Oct
- CVE-2026-118527 Exploited added to KEV 30 Oct
Products we track
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by Recorded Future BlogOctober 2026 sees 82 high-impact CVEs prioritised, 13% fewer than September
- Zero-day reported by CISA AlertsIvanti patches two more Connect Secure zero-days exploited in chained attacks
- Zero-day reported by GBHackersHackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
Recent news
October 2026 sees 82 high-impact CVEs prioritised, 13% fewer than September
Recorded Future's Insikt Group identified 82 high-impact vulnerabilities for October 2026, 52 with a Very Critical risk score, down 13% from 94 in September. Of these, 36 were surfaced through CISA's KEV catalogue, 33 from open sources and 13 only from honeypot data, across products from 51 vendors, with Citrix and Microsoft together accounting for about 15%. Insikt also published Nuclei detection templates for the two PHP2Shell flaws and for CVE-2026-87902 and CVE-2026-86124.
Ivanti patches two more Connect Secure zero-days exploited in chained attacks
Ivanti has issued fixes for CVE-2026-111357 and CVE-2026-118527, two further flaws in Connect Secure that were chained with CVE-2026-104935 in zero-day attacks, with activity dating back to at least 1 October. Volexity attributes the chain to UTA0576, which gained unauthenticated root access on an appliance running 22.8R2.4, and observed credential theft and Active Directory queries for LAPS passwords and BitLocker keys. CISA added the two new flaws to its KEV catalogue on 30 October 2026, and the 13 October fixes do not cover them.
Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
A chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances allowed attackers to execute commands with root privileges, steal credentials and probe internal networks. Volexity has tracked the unknown actor as UTA0576 and says the exploitation dates back to 3 October 2026, against an appliance that was fully patched at the time.