Known vulnerabilities in Endpoint Manager 2022 SU5

Vendor: Ivanti
Software: Endpoint Manager
Version: 2022 SU5
Software CPE: cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
Website: https://www.ivanti.com/
Total vulnerabilities: 64
Public exploits: 2
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Endpoint Manager version 2022 SU5 Endpoint Manager 2022 SU5 is affected by 64 vulnerabilities: 2 critical, 13 high, 23 medium, 26 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141421 - Out-of-bounds read
CVE-2026-18125		 CWE-125 Medium
No
No
 2024 SU7 11.08.2026 SB2026081132
#VU141422 - External Control of File Name or Path
CVE-2026-18127		 CWE-73 Low
No
No
 2024 SU7 11.08.2026 SB2026081132
#VU141423 - Improper Certificate Validation
CVE-2026-18129		 CWE-295 Medium
No
No
 2024 SU7 11.08.2026 SB2026081132
#VU131192 - Exposed Dangerous Method or Function
CVE-2026-8109		 CWE-749 Low
No
No
 2024 SU6 12.05.2026 SB2026051290
#VU131193 - Incorrect Permission Assignment for Critical Resource
CVE-2026-8110		 CWE-732 Low
No
No
 2024 SU6 12.05.2026 SB2026051290
#VU131194 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-8111		 CWE-89 Medium
No
No
 2024 SU6 12.05.2026 SB2026051290
#VU122573 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-1603		 CWE-288 High
No
Exploited
 2024 SU5 10.02.2026 SB2026021080
#VU122568 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-1602		 CWE-89 Medium
No
No
 2024 SU5 10.02.2026 SB2026021080
#VU119425 - Improper Verification of Cryptographic Signature
CVE-2025-13662		 CWE-347 Medium
No
No
 2024 SU4 SR1 09.12.2025 SB2025120941
#VU119424 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-13661		 CWE-22 Medium
No
No
 2024 SU4 SR1 09.12.2025 SB2025120941
#VU119423 - Improper Control of Dynamically-Managed Code Resources
CVE-2025-13659		 CWE-913 High
No
No
 2024 SU4 SR1 09.12.2025 SB2025120941
#VU119422 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-10573		 CWE-79 High
No
No
 2024 SU4 SR1 09.12.2025 SB2025120941
#VU118305 - Incorrect Default Permissions
CVE-2025-10918		 CWE-276 Low
No
No
 2024 SU4 11.11.2025 SB2025111171
#VU117120 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62392		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117121 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62390		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117122 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62389		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117123 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62388		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117124 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62387		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117125 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62385		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100
#VU117126 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-62391		 CWE-89 Medium
No
No
 - 14.10.2025 SB20251014100


Showing elements 1 - 20 out of 64