Critical severity · published Jan 12, 2024
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
RansomwareIn wildKEV
9.1
CVSS
100%
EPSS
Yes
On KEV
Description
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 10, 2024
Federal remediation dueJan 22, 2024
Ransomware campaign useKnown
Affected products
Which versions
CS
Connect Secure · Ivanti
9.1R18 through 9.1R18; 22.6R2 through 22.6R2 · source: vendor, NVD
IP
IPS · Ivanti
9.1R18 through 9.1R18; 22.6R1 through 22.6R1 · source: vendor
PS
Policy Secure · Ivanti
9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +31 more · source: NVD
CS
Connect Secure and Policy Secure · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21887
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forums.ivanti.com
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
packetstormsecurity.com
http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
More from Connect Secure
10.0
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
8.8
CVE-2021-22899
Ivanti Pulse Connect Secure Command Injection Vulnerability