Skip to content
COOEY

FAIL › dossier

connect secure

PRODUCT

· dossier confidence 0%

Ivanti Connect Secure is a network security product with a documented history of severe, critical, and high-severity vulnerabilities, including multiple buffer overflows, command injections, and an unauthenticated RCE. Its security posture is compromised by a pattern of systemic flaws requiring urgent patching and architectural review for CMMC compliance.

Failure events
5
Zero-days
0
RCEs
1
On KEV
1
Critical
4
Worst shame
85
PROFILE
CategoryNetwork SecurityWhat they doIvanti Connect Secure is a network security and access control solution that provides secure remote access, identity management, and threat protection for enterprise environments.
SECURITY POSTURE

The product has a severe track record of critical and high-severity vulnerabilities, including multiple stack-based buffer overflows, command injection flaws, and an unauthenticated remote code execution (RCE) vulnerability, indicating systemic issues in secure coding and patch management.

Notable failures
  • CVE-2026-104935: High RCE via spoofing bypassing authentication
  • CVE-2025-22457: Critical stack-based buffer overflow
  • CVE-2025-0282: Critical stack-based buffer overflow
  • CVE-2024-21887: Critical command injection in web components
  • CVE-2021-22893: Critical authentication bypass
Patterns: repeated critical stack-based buffer overflows; unpatched or late-patched high-severity RCE and authentication bypass vulnerabilities; web component command injection flaws
FAILURE HISTORY · 5
DATEEVENTSEVSUMMARY
2026-10-13 CVE-2026-104935 high Ivanti Connect Secure allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands via a spoofing vulnerability.
2025-04-03 CVE-2025-22457 critical CVE-2025-22457: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6,
2025-01-08 CVE-2025-0282 critical CVE-2025-0282: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5,
2024-01-12 CVE-2024-21887 critical CVE-2024-21887: A command injection vulnerability in web components of Ivanti Connect Secure (9.
2021-04-23 CVE-2021-22893 critical CVE-2021-22893: Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication b
DOSSIER SOURCES
Open questions: Company founding date and headquarters location · Company size and ownership structure · Official website URL
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-10-14 04:27:35.332548+00:00