9.1 Critical Exploited · ransomware

CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Known to be used

Weakness CWE-77

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Affected products and versions

Product	Affected versions	Fixed in
ICS	22.6R2	No fix stated
ICS	9.1R18	No fix stated
IPS	22.6R1	No fix stated
IPS	9.1R18	No fix stated

References

forums.ivanti.com forums.ivanti.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published January 12, 2024
Added to the KEV catalogue January 10, 2024
Last modified August 4, 2026

The 5 CVEs of ICS →

CVE-2024-22024 An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy… 8.3 High CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability 8.2 High CVE-2024-21888 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure… 8.8 High CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability 8.2 High

Track this CVE