Ivanti Virtual Traffic Manager vulnerabilities

2 CVEs affecting Ivanti Virtual Traffic Manager, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-8051, published 2026-05-12.

More from Ivanti.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability, published 2024-08-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-09-24. EPSS: 100% chance of exploitation in the next 30 days. Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
• CVE-2026-8051, published 2026-05-12. High severity, CVSS 7.2. EPSS: 3% chance of exploitation in the next 30 days. OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.