TI-2024-09135 Aliases CVE-2024-9844 GHSA-7g9r-c948-vw87

Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure…

MEDIUM 40CWE-602Published 2024-12-10 · Updated 2024-12-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00987 62nd percentileScored 2026-11-07

Fix Fixed Connect Secure (Ivanti): 22.7R2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ivanti	Connect Secure	—	22.7R2.4	Patch available	CNA

Connect Secure VendorIvanti Affected — Fixed in 22.7R2.4 Patch available CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:ivanti:connect_secure::::::::	before 22.7	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:-::::::	22.7	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1::::::	22.7 r1	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1::::::	22.7 r1.1	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2::::::	22.7 r1.2	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3::::::	22.7 r1.3	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4::::::	22.7 r1.4	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5::::::	22.7 r1.5	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2::::::	22.7 r2	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2.1::::::	22.7 r2.1	Vulnerable	Ivanti

cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* Versions before 22.7 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:* Versions 22.7 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:* Versions 22.7 r1 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:* Versions 22.7 r1.1 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:* Versions 22.7 r1.2 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:* Versions 22.7 r1.3 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:* Versions 22.7 r1.4 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:* Versions 22.7 r1.5 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:* Versions 22.7 r2 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:* Versions 22.7 r2.1 Vulnerable ·Ivanti

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:ivanti:connect_secure:22.7:r2.2::::::	22.7 r2.2	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2.3::::::	22.7 r2.3	Vulnerable	Ivanti

cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:* Versions 22.7 r2.2 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:* Versions 22.7 r2.3 Vulnerable ·Ivanti

Remediation

Fix · CNA Connect Secure (Ivanti) Fixed in 22.7R2.4

Timeline

2026-10-02 Threatist record created from CVE-2024-9844
2026-10-03 Alias added: GHSA-7g9r-c948-vw87

References

Advisory 1

https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs

TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8

See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences