VULNERABILITY INTELLIGENCE

CVE-2024-21887

CVSS score9.1 CRITICAL

EPSS probability100.00%

CISA KEVKnown exploited vulnerability

Published2024-01-12

Last modified2026-08-04

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Vendor / product: Ivanti / Connect Secure and Policy Secure

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Weakness classification

nvd@nist.gov: CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Primary references

support@hackerone.com — Exploit, Third Party Advisory, VDB Entry
support@hackerone.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource