Will the Ivanti Connect Secure product line receive 3 or more new critical CVEs (CVSS 9.0+) in 2026?

Ivanti Connect Secure and Policy Secure VPN appliances were among the most exploited products of 2024–2025, with multiple CVSS 9.0+ vulnerabilities being actively weaponized by nation-state actors within days of disclosure. CISA issued an emergency directive in January 2024. This market forecasts whether the pattern continues with 3+ new critical CVEs in 2026.

Resolution Criteria

Resolves YES if: The NVD publishes 3 or more distinct CVEs in Ivanti Connect Secure or Ivanti Policy Secure with a CVSS base score of 9.0 or higher before 2026-12-01.