Loading story…
Ivanti released a security update for Ivanti Desktop and Server Management (DSM) to address CVE-2026-3483, a high-severity local privilege escalation flaw affecting DSM versions up to and including 2026.1. The issue is described as an exposed dangerous method (CWE-749) that could allow a local authenticated attacker to elevate privileges with low attack complexity and no user interaction once they already have access to a target system.
Ivanti states it has no evidence of exploitation in the wild at the time of disclosure and that the vulnerability does not impact other Ivanti solutions. The fix is available in DSM 2026.1.1 (distributed via the Ivanti License System), and organizations running affected versions are advised to prioritize upgrading and follow Ivanti’s security advisory remediation guidance.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-10, the Canadian Centre for Cyber Security published advisory AV26-214 referencing Ivanti's disclosure of CVE-2026-3483. It encouraged organizations to review Ivanti's guidance and apply the necessary updates to remediate the issue.
Ivanti said the vulnerability was fixed in DSM version 2026.1.1 and made the update available through the Ivanti License System. The company urged customers running DSM 2026.1 or earlier to update promptly and stated it was not aware of active exploitation or public IOCs at disclosure time.
On 2026-03-10, Ivanti published a security advisory for a high-severity local privilege escalation vulnerability, CVE-2026-3483, affecting Ivanti Desktop and Server Management (DSM) 2026.1 and earlier. The flaw was described as an exposed dangerous method that an authenticated local user could abuse to gain elevated privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourceivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti released security updates for eight vulnerabilities across **Cloud Services Application (CSA)**, **Connect Secure (ICS)**, **Policy Secure (IPS)**, **Desktop and Server Management (DSM)**, **Sentry**, and **Patch SDK**, including five rated critical. The most severe issues affect CSA, ICS, and IPS and could allow **SQL injection**, **remote code execution**, **authentication bypass**, and ultimately full system compromise, while a separate advisory also addressed **`CVE-2024-7572`** in DSM. Additional flaws can lead to denial of service, unauthorized system changes, file deletion, and bypass of security mechanisms. Ivanti said Patch SDK exposure also affects dependent products including **Endpoint Manager**, **Security Controls**, **Patch for Configuration Manager**, **Neurons for Patch Management**, and **Neurons Agent Platform**, and urged customers to upgrade immediately to supported fixed versions for ICS, IPS, DSM, and other impacted platforms.
Jul 23, 2026
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
Jun 29, 2026
Ivanti released security updates for two enterprise products, fixing multiple vulnerabilities in **Ivanti Secure Access Client for Windows** and **Ivanti Virtual Traffic Manager (vTM)**. In Secure Access Client, version `22.8R6` addresses **CVE-2026-7431**, an incorrect permissions issue that could let a local authenticated user read or modify sensitive log data; **CVE-2026-7432**, a race condition that could allow local privilege escalation to `SYSTEM`; and **CVE-2026-8992`, an improper certificate validation flaw that could enable remote unauthenticated code execution. Ivanti said affected Secure Access Client versions are `22.8R5` and earlier and advised customers to upgrade to `22.8R6`. Ivanti also patched **CVE-2026-8051** in **Ivanti Virtual Traffic Manager**, a high-severity `CWE-78` OS command injection vulnerability with a CVSS score of `7.2` that could allow a remote authenticated administrator to achieve remote code execution. The flaw affects vTM `22.9r3` and earlier and is fixed in `22.9r4`. Ivanti said it was not aware of customer exploitation of any of the disclosed issues before publication and said the vulnerabilities were reported through its responsible disclosure program, crediting William Söderberg of Reversec for the vTM finding.
Jun 29, 2026