Ivanti
Ivanti declares 35 subprocessors, plus 14 of its own affiliates, in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and Microsoft. No published changes since we first read it on Sep 28, 2026.
Not listed by any tracked vendor.
Not loaded by any published homepage.
Subprocessors CSV of Ivanti's subprocessors · Atom feed of Ivanti's subprocessors DORA draft CSV of Ivanti's subprocessors as declared by Ivanti what's this? ·
35 third parties, 14 affiliates.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services, Inc. | Infrastructure and data hosting, CDN, Operations; Ivanti End Point Manager Mobile (Core) App Gateway, Dedicated Core | Australia, Canada, Germany, India, United Kingdom, United States; Australia, Canada, Germany, Ireland, Japan, Singapore, United Kingdom, United States; Australia, Germany, Japan, United States; United States | |
| Benison Tech USA, Inc. | Engineering contractor services | India | |
| Clickatell, Inc. | This service is Optional. Online messaging service provider for device users with non-US phone numbers | United States | |
| Cloudflare, Inc. | Web monitoring, WAF, Denial of Service protection, and CDN provider | United States | |
| Confluent, Inc. | Facilitates Neurons for MDM outgoing messaging, data replication and logging | United States | |
| Coveo Solutions, Inc. | Support Community intelligent search tool | United States | |
| Crowdstrike, Inc. | Endpoint and Cloud Workload Protection; 24/7 managed detection and response provider | United States | |
| Cynerio, Inc. | IoT platform for Ivanti Neurons for Healthcare, escalated support | United States | |
| Elastic Search, Inc. | Data hosting for Neurons for MDM | United States | |
| EPAM Systems, Inc. | Engineering contractor services | Armenia, Georgia, India, Kazakhstan, United States, Uzbekistan | |
| Espressive, Inc. | Espressive's Barista Chatbot is integrated into Ivanti Neurons Digital Assistant | United States | |
| Google LLC | Google Maps API feature in the administrative and self-service portals | United States | |
| Intel | Intel provides API access for 'Chip to Cloud' functionality, which allows for remote management of vPro capabilities. This is an optional feature. | United States | |
| Kiteworks USA, LLC | Secure file transfer | United States | |
| Lookout, Inc. | Integrated Cloud Access Security Broker and Secure Web Gateway for Ivanti Neurons for Zero Trust Access, escalated support services; Partnered with Lookout to provide Ivanti Neurons for Mobile Threat Defense as an integrated add-on to Ivanti Neurons for Unified Endpoint Management; escalated support | Canada, Germany, India, Japan, Singapore, United States, Ireland; Canada, United States, Ireland | |
| Macstadium, Inc. | Infrastructure as a Service provider for Incapptic Connect | Ireland | |
| Microsoft Corporation AI | Microsoft Azure services including providing infrastructure and data hosting, CDN, Operations; Microsoft Azure services including providing infrastructure and data hosting, CDN, Operations. Use of OpenAI models for AI features.; Microsoft suite of applications and services within the organization | Australia, Canada, Germany, Ireland, Japan, Singapore, United Kingdom, United States; Australia, Canada, Germany, Japan, United Kingdom, United States; Australia, Canada, Germany, United Kingdom, United States; Australia, Canada, Netherlands, United Kingdom, United States; Canada, Netherlands, Singapore, United Arab Emirates, United States; United States | |
| MongoDB Limited | Storage of environment configuration, engine data, and audit logs | United States, Ireland | |
| NetNumber Inc. | Carrier and country lookup | Netherlands, United States | |
| New Relic, Inc. | Logging, Infrastructure monitoring & application monitoring | United States | |
| Odeen Software S.R.L. | Engineering support services | Romania | |
| Pendo.io, Inc. | In-app guides, product adoption and usage analytics | EU Multi-Region | |
| Persistent Systems Limited | Engineering support services | India | |
| Progress Software Corporation | Secure file transfer | United States | |
| Qualys, Inc. | Vulnerability Management | United States | |
| Rackspace US, Inc. | This service is Optional. Outbound email relay service | United States | |
| Salesforce.com, Inc. | Customer Relationship Management System | United States | |
| Securin, Inc. | Provision of Attack Surface Management API | United States | |
| SendGrid, Inc. | SendGrid email relay service | United States | |
| Splunk, Inc. | Logging used for trouble shooting | United States | |
| TeamViewer Germany GmbH | Help@Work integration. Provide remote access capabilities to the mobile device | Germany | |
| Virima, Inc. | Ivanti Neurons for Discovery Service Mapping, escalated support | United States | |
| Vonage Business, Inc. | Phone management and support | United States | |
| Workato, Inc. | iPaaS platform for Ivanti Neurons for ITSM, ITAM and Line of Business | Australia, Germany, United States | |
| Zimperium, Inc. | Partnered with Zimperium to provide Ivanti Mobile Threat Defense administrative console, and for escalated support | Australia, Germany, Japan, Singapore, United States |
Ivanti affiliates (14)
Web TechnologiesCSV of Ivanti's web technologies · Atom feed of Ivanti's web technologies
Ivanti's homepage made 259 requests to 30 domains, and 18 services controlled by another company.
18 third parties by category: Advertising 6Analytics 6Marketing automation 1Cookie compliance 1Other 2Unclassified 2
Third parties 18 · 165 requests
6Sense Insights, Inc. 6sense 19
Crazy Egg Crazy Egg 4
Reddit, Inc. Reddit Ads 2
CRAID Inc. (ADMATRIX) admatrix.jp 1
First party 1 · 94 requests
Ivanti Cloudflare Eloqua GSAP 3.12.7 HSTS HTTP/3 Microsoft ASP.NET Microsoft Application Insights Microsoft Clarity Open Graph OptinMonster Vimeo jQuery 3.6.0 lit-element 3.3.2 lit-html 2.7.4 94
11 tracked companies loaded by the homepage are not in Ivanti's subprocessor list. A website can use a service without it processing customer data.
ComplianceCSV of Ivanti's compliance · Atom feed of Ivanti's compliance
FedRAMP Marketplace
| Offering | Status | Impact | Agencies | Since |
|---|---|---|---|---|
| Ivanti Neurons for ITSM (Formerly Service Manager) | Authorized | Moderate | 3 | |
| Ivanti Neurons for MDM (Formerly MobileIron) | Authorized | Moderate | 4 |
FedRAMP status from the FedRAMP Marketplace (evidence)
Security recordCSV of Ivanti's security record · Atom feed of Ivanti's security record
What public security catalogs list for Ivanti, in their words.
Known exploited vulnerabilities
38 vulnerabilities in Ivanti's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2026-111357 | Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | |
| CVE-2026-118527 | Connect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | |
| CVE-2026-104935 | Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | |
| CVE-2026-10520 | Sentry | Ivanti Sentry OS Command Injection Vulnerability | |
| CVE-2026-6973 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | |
| CVE-2026-1340 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | |
| CVE-2026-1603 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | |
| CVE-2026-1281 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | |
| CVE-2025-4427 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | |
| CVE-2025-4428 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
28 more
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2025-22457 | Connect Secure, Policy Secure, and ZTA Gateways | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability used by ransomware | |
| CVE-2024-13159 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| CVE-2024-13160 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| CVE-2024-13161 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | |
| CVE-2025-0282 | Connect Secure, Policy Secure, and ZTA Gateways | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability used by ransomware | |
| CVE-2024-9379 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | |
| CVE-2024-9380 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | |
| CVE-2024-29824 | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | |
| CVE-2024-7593 | Virtual Traffic Manager | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | |
| CVE-2024-8963 | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | |
| CVE-2024-8190 | Cloud Services Appliance | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | |
| CVE-2021-44529 | Endpoint Manager Cloud Service Appliance (EPM CSA) | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability used by ransomware | |
| CVE-2024-21893 | Connect Secure, Policy Secure, and Neurons | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability used by ransomware | |
| CVE-2023-35082 | Endpoint Manager Mobile (EPMM) and MobileIron Core | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability used by ransomware | |
| CVE-2023-46805 | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability used by ransomware | |
| CVE-2024-21887 | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability used by ransomware | |
| CVE-2023-38035 | Sentry | Ivanti Sentry Authentication Bypass Vulnerability used by ransomware | |
| CVE-2023-35081 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | |
| CVE-2023-35078 | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability used by ransomware | |
| CVE-2019-11510 | Pulse Connect Secure | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability used by ransomware | |
| CVE-2019-11539 | Pulse Connect Secure and Pulse Policy Secure | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability used by ransomware | |
| CVE-2020-15505 | MobileIron Multiple Products | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | |
| CVE-2020-8243 | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | |
| CVE-2020-8260 | Pulse Connect Secure | Ivanti Pulse Connect Secure Code Execution Vulnerability | |
| CVE-2021-22893 | Pulse Connect Secure | Ivanti Pulse Connect Secure Use-After-Free Vulnerability used by ransomware | |
| CVE-2021-22894 | Pulse Connect Secure | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability | |
| CVE-2021-22899 | Pulse Connect Secure | Ivanti Pulse Connect Secure Command Injection Vulnerability | |
| CVE-2021-22900 | Pulse Connect Secure | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability |
Source: CISA Known Exploited Vulnerabilities catalog (evidence)
Service statusCSV of Ivanti's status page incidents · Atom feed of Ivanti's status page incidents
90 days agotoday
- 32 incidents in 90 days
- 10 major or critical
- 4 h typical time to resolve
- 21 days longest major
| Began | Incident | Impact | Lasted |
|---|---|---|---|
| Ivanti Neurons - Users may be unable to create or delete reports (2055298) | no impact stated | 58 min | |
| IRW-PRD – Email Service Issue | no impact stated | 27 h 28 min | |
| Ivanti Neurons Service Degradation for https://login.mobileiron.com | minor | 27 min | |
| FFZ PRD - Connectivity Issue | no impact stated | 2 h 52 min | |
| Ivanti Neurons MDM - https://ap1.mobileiron.com - Service degradation | minor | 4 h 30 min | |
| Ivanti Neurons Platform: Automation Engine Performance Degradation - 2033190 | minor | 17 h 23 min | |
| LDZ STG/UAT - Performance and Connection Issues | minor | 5 days | |
| IAZ PRD – Tenant login issues affecting some tenants | major | 12 h 51 min |
Incidents per month
critical major minor no impact stated
Components affected
| Component | Incidents | Bar |
|---|---|---|
| Ivanti Neurons Platform (NVU) | 2 | |
| Service Manager / Asset Manager (FFZ) | 2 | |
| Ivanti Neurons Platform (FRU) | 1 | |
| Ivanti Neurons Platform (MLU) | 1 | |
| Ivanti Neurons Platform (TKU) | 1 | |
| Ivanti Neurons Platform (TTU) | 1 | |
| Ivanti Neurons Platform (UKU) | 1 | |
| Service Manager / Asset Manager (IAZ) | 1 |
As Ivanti's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)
Incidents reported by Ivanti's subprocessorsCSV of incidents reported by vendors Ivanti lists · Atom feed of incidents reported by vendors Ivanti lists
235 reported incidents in the last 30 days, by 9 of the vendors Ivanti lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that Ivanti was involved.
And 210 more. All of them: CSV · Who is around them.
ChangesCSV of Ivanti's changes · Atom feed of Ivanti's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for Ivanti's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/ivanti"><img src="https://thirdpartyindex.com/badge/ivanti.svg" alt="Ivanti transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/ivanti)