High severity · published Jan 31, 2024
CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
RansomwareIn wildKEV
8.2
CVSS
100%
EPSS
Yes
On KEV
Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 31, 2024
Federal remediation dueFeb 2, 2024
Ransomware campaign useKnown
Affected products
Which versions
CS
Connect Secure · Ivanti
9.1R18 through 9.1R18; 22.6R2 through 22.6R2 · source: vendor, NVD, CISA
IP
IPS · Ivanti
9.1R18 through 9.1R18; 22.6R1 through 22.6R1 · source: vendor
NF
Neurons For Zero-trust Access · Ivanti
22.2; 22.2; 22.2; 22.3; 22.3; 22.4; +5 more · source: NVD
PS
Policy Secure · Ivanti
9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more · source: NVD, CISA
CS
Connect Secure, Policy Secure, and Neurons · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21893
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forums.ivanti.com
https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
More from Connect Secure
10.0
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability