Ivanti Desktop & Server Management vulnerabilities

6 CVEs affecting Ivanti Desktop & Server Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-3483, published 2026-03-10.

More from Ivanti.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-38648, published 2025-07-12. Medium severity, CVSS 5.7. EPSS: 0.6% chance of exploitation in the next 30 days. A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.
• CVE-2026-3483, published 2026-03-10. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.
• CVE-2023-28129, published 2023-08-10. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user.
• CVE-2024-29821, published 2024-10-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
• CVE-2024-29213, published 2024-10-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
• CVE-2024-7572, published 2024-12-10. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.