Vulnerability Disclosure Program

Contents
Introduction ............................................................................................................................................ 2
In Scope ................................................................................................................................................... 2
Out of Scope............................................................................................................................................ 2
Vulnerability Rewards ............................................................................................................................. 3
Reporting Channels ................................................................................................................................. 3
Codes of Conduct .................................................................................................................................... 4
Legal Safe Harbor .................................................................................................................................... 4

Introduction
At Ivanti, we are dedicated to ensuring the security and integrity of our enterprise software
products. We recognize the vital role that security researchers, ethical hackers, and thebroader security community play in identifying and reporting vulnerabilities. This
Vulnerability Disclosure Policy outlines our commitment to working collaboratively withsecurity researchers to improve the security of our software. It outlines steps for reporting
vulnerabilities, what we expect, and what you can expect from us.
If you encounter any security-related issues involving Ivanti Products or Solutions, including
those related to products from companies acquired by Ivanti (such as Pulse Secure, Cherwelland MobileIron), or if you have security findings related to Ivanti infrastructure, we encourage
you to report them through one of the channels described in ‘Reporting Channels’. Your
watchful eyes and contributions are instrumental in safeguarding the security of our products
and maintaining the integrity of our infrastructure. We appreciate your commitment toenhancing Ivanti's security efforts. Thank you for partnering with us in this importantendeavor.

In Scope
The vulnerability disclosure policy applies to any digital asset owned, operated, or maintained
within Ivanti, including Ivanti’s products and services and Ivanti’s IT and OT infrastructure(including its systems and network).

Out of Scope
The following types of attacks are not considered part of our Vulnerability Disclosure
Program:

Denial of Service attacks, including resource exhaustion attacks, exploits causing
denial of service, or any form of "resiliency testing" against Ivanti Corporate or Ivanti
Hosted Solutions that could lead to service disruption.
Physical testing of Ivanti Offices, Data Centers, Colocation facilities, etc.
Social Engineering of our employees, customers, partners, etc.
Any attack or event against an Ivanti product or solution hosted by a customer in theirown network without prior approval for testing.
Automated scanners (add appropriate language)Vulnerability Rewards
In addition to this Vulnerability Disclosure Program, Ivanti operates a specialized bug-bounty
program on HackerOne for selected Ivanti Products. This exclusive program is invitation-only,
granting security researchers access to dedicated environments that host Ivanti Products.
If your vulnerability report affects a product within scope of Ivanti’s bug-bounty program,
your report will be moved to Ivanti’s bug-bounty program, and you may receive a bounty
award. Please visit https://hackerone.com/ivanti?type=team for more details.
Ivanti reserves the exclusive right to assess and qualify submissions for bounty rewards in its
sole discretion.

Reporting Channels
If you have discovered a security vulnerability in any Ivanti enterprise software product orservice, we encourage you to report it to us in a responsible and coordinated manner throughone of these modes:
1. Easy to use Vulnerability Report Submission Form.
2. Email to responsible.disclosure@ivanti.com. Your report should include the following
information:a.
A detailed description of the vulnerability.
b.
Proof of Concept [PoC], if applicable.
c.
Steps to reproduce the vulnerability.
d.
Information about the affected product or service and its version.
e.
Your contact information, including your name, email address, and any
additional contact details.
If you wish to encrypt our communication, please use our PGP key here (Fingerprint:
5A86 C77C A361 B145 8A2C D672 DBF5 C7A9 FE96 C03D).
3. For general security inquiries, please write to security@ivanti.com.

Vulnerability Report Handling Procedure

In response to your report, our VDP/bug-bounty partner, HackerOne will respond toyou promptly, and work with you to understand and validate your report.
Our security team will work to validate the vulnerability within ten business days after
receiving it.
Once the vulnerability is confirmed, Ivanti will prioritize its resolution based on theseverity. We will provide regular updates to the reporter on the status of theremediation process.
We are committed to addressing and mitigating the reported vulnerability in goodfaith. We may seek input or assistance from the reporter as necessary.

Ivanti may, from time to time, approve and make available more specific proceduresfor handling certain types of security vulnerabilities. Those additional procedures areextensions of this Vulnerability Disclosure Program.

Codes of Conduct


Play by the rules, including following this policy and any other relevant agreements. If
there is any inconsistency between this policy and any other applicable terms, theterms of this policy will prevail.
Report any vulnerability you’ve discovered promptly.
Avoid violating the privacy of others, disrupting our systems, destroying data, and/orharming user experience.
Use only the ‘Official Channels’ to discuss vulnerability information with us.
Provide us with a reasonable amount of time (at least 90 days from the initial report)
to resolve the issue before you disclose it publicly.
If a vulnerability provides unintended access to data: Limit the amount of data youaccess to the minimum required for effectively demonstrating a Proof of Concept; andcease testing and submit a report immediately if you encounter any user data during
testing, such as Personally Identifiable Information (PII), Personal Healthcare
Information (PHI), credit card data, or proprietary information.
You should only interact with test accounts you own or with explicit permission fromthe account holder; andDo not engage in extortion.

Legal Safe Harbor
To encourage research and responsible disclosure of security vulnerabilities, Ivanti will notpursue legal action against security researchers who make a good faith effort to comply withand report security vulnerabilities in accordance with this Voluntary Disclosure Program.
Please understand that if your security research involves the networks, systems, information,applications, products, or services of a third party (which is not us), we cannot bind that thirdparty, and they may pursue legal action or notify law enforcement. We cannot and do notauthorize security research in the name of other entities, and cannot in any way offer todefend, indemnify, or otherwise protect you from any third-party action based on youractions.
You are expected, as always, to comply with all laws applicable to you, and not to disrupt orcompromise any data beyond what our Voluntary Disclosure Program permits.
Please contact us before engaging in conduct that may be inconsistent with or unaddressedby this policy. We reserve the sole right to make the determination of whether you made agood faith effort to comply with and report security vulnerabilities in accordance with thisVoluntary Disclosure Program, and proactive contact to us before engaging in any action is asignificant factor in that decision. If in doubt, ask us first!