Read the docs
TI-2024-14549 Aliases CVE-2024-21887GHSA-87qj-c5f7-6c8q

Command injection in Ivanti ICS

Priority CRITICAL 98Exploited in the wildCWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Why it matters now

Exploitation Active In CISA KEV since 2024-01-10CISA due date 2024-01-22Known ransomware use
EPSS 0.99999 100th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiICS9.1R18 – 9.1R18; 22.6R2 – 22.6R2—No fix listedCNA
IvantiIPS9.1R18 – 9.1R18; 22.6R1 – 22.6R1—No fix listedCNA
  • ICS VendorIvanti Affected 9.1R18 – 9.1R18; 22.6R2 – 22.6R2 Fixed in — No fix listed CNA
  • IPS VendorIvanti Affected 9.1R18 – 9.1R18; 22.6R1 – 22.6R1 Fixed in — No fix listed CNA

CPE configurations NVD · 81

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*9.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*9.1 r11.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*9.1 r11.4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*9.1 r11.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*9.1 r12.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* Versions 9.1 r11.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* Versions 9.1 r11.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:* Versions 9.1 r11.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:* Versions 9.1 r12.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
Show 71 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*9.1 r15.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*9.1 r16.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*9.1 r17.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*9.1 r4.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*9.1 r9.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*22.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*22.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*22.3 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*22.4 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*22.4 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*22.5 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*22.6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*22.6 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*22.6 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*9.0VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*9.1 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*22.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*22.2 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*22.3 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*22.3 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*22.4 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*22.4 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*22.4 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*22.5 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*22.5 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*22.6 r1VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:* Versions 9.1 r15.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:* Versions 9.1 r16.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:* Versions 9.1 r17.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:* Versions 9.1 r4.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:* Versions 9.1 r9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:* Versions 22.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:* Versions 22.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:* Versions 22.3 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:* Versions 22.4 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:* Versions 22.5 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:* Versions 22.6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:* Versions 22.6 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:* Versions 22.6 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:* Versions 9.1 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:* Versions 22.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:* Versions 22.2 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:* Versions 22.3 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:* Versions 22.3 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:* Versions 22.4 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:* Versions 22.4 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:* Versions 22.5 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:* Versions 22.5 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:* Versions 22.6 r1 Vulnerable ·Ivanti

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-01-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-21887
  3. 2026-10-03 Alias added: GHSA-87qj-c5f7-6c8q

References

Exploit 1

Advisory 1

  • TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
  • TI-2021-05755 Code injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences