TI-2024-10196 Aliases CVE-2024-11005 GHSA-m9rx-mmjv-j7v6

OS command injection in Ivanti Connect Secure

MEDIUM 45CWE-78Published 2024-11-12 · Updated 2024-11-22

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01641 76th percentileScored 2026-11-07

Fix Fixed Connect Secure (Ivanti): 22.7R2.1Policy Secure (Ivanti): 22.7R1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ivanti	Connect Secure	—	22.7R2.1	Patch available	CNA
Ivanti	Policy Secure	—	22.7R1.1	Patch available	CNA

Connect Secure VendorIvanti Affected — Fixed in 22.7R2.1 Patch available CNA
Policy Secure VendorIvanti Affected — Fixed in 22.7R1.1 Patch available CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:ivanti:connect_secure::::::::	before 9.1; after 9.1, before 22.7	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:-::::::	22.7	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1::::::	22.7 r1	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1::::::	22.7 r1.1	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2::::::	22.7 r1.2	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3::::::	22.7 r1.3	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4::::::	22.7 r1.4	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5::::::	22.7 r1.5	Vulnerable	Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2::::::	22.7 r2	Vulnerable	Ivanti
cpe:2.3:a:ivanti:policy_secure::::::::	before 9.1; after 9.1, before 22.7	Vulnerable	Ivanti

cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* Versions before 9.1; after 9.1, before 22.7 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:* Versions 22.7 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:* Versions 22.7 r1 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:* Versions 22.7 r1.1 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:* Versions 22.7 r1.2 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:* Versions 22.7 r1.3 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:* Versions 22.7 r1.4 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:* Versions 22.7 r1.5 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:* Versions 22.7 r2 Vulnerable ·Ivanti
cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:* Versions before 9.1; after 9.1, before 22.7 Vulnerable ·Ivanti

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:ivanti:policy_secure:22.7:r1::::::	22.7 r1	Vulnerable	Ivanti

cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:* Versions 22.7 r1 Vulnerable ·Ivanti

Remediation

Fix · CNA Connect Secure (Ivanti) Fixed in 22.7R2.1
Fix · CNA Policy Secure (Ivanti) Fixed in 22.7R1.1

Timeline

2026-10-02 Threatist record created from CVE-2024-11005
2026-10-03 Alias added: GHSA-m9rx-mmjv-j7v6

References

Advisory 1

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8

See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences