7.2
High
Exploited
CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Ransomware campaigns
Not observed so far
Weakness
CWE-77
Description
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CSA (Cloud Services Appliance) 5.0 | earliest → < 5.0.2 | 5.0.2 |
| endpoint_manager_cloud_services_appliance 5.0 | earliest → < 5.0.2 | 5.0.2 |
References
- forums.ivanti.com forums.ivanti.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of CSA (Cloud Services Appliance)
The 6 CVEs of CSA (Cloud Services Appliance) →
CVE-2025-22460
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to…
7.8
High
CVE-2024-9381
Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass…
7.2
High
CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
6.5
Medium
CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
9.4
Critical