Ivanti Patches Multiple Vulnerabilities in Secure Access, Xtraction, vTM and Endpoint Manager

Ivanti's May 2026 Patch Tuesday advisory discloses multiple vulnerabilities in Secure Access Client, Xtraction, Virtual Traffic Manager, and Endpoint Manager — ranging from local privilege escalation and sensitive log/credential exposure to path traversal enabling file writes, OS command injection (admin-authenticated), and a SQL injection in the EPM web console that can lead to remote code execution; Ivanti says there is no known in-the-wild exploitation and recommends immediate patching, noting several flaws were discovered using AI-assisted review.