Read the docs
TI-2024-14554 Aliases CVE-2024-21893GHSA-5rr9-mqhj-7cr2

Server-side request forgery in Ivanti ICS

Priority CRITICAL 93Exploited in the wildCWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Why it matters now

Exploitation Active In CISA KEV since 2024-01-31CISA due date 2024-02-02Known ransomware use
EPSS 0.99999 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiICS9.1R18 – 9.1R18; 22.6R2 – 22.6R2—No fix listedCNA
IvantiIPS9.1R18 – 9.1R18; 22.6R1 – 22.6R1—No fix listedCNA
  • ICS VendorIvanti Affected 9.1R18 – 9.1R18; 22.6R2 – 22.6R2 Fixed in — No fix listed CNA
  • IPS VendorIvanti Affected 9.1R18 – 9.1R18; 22.6R1 – 22.6R1 Fixed in — No fix listed CNA

CPE configurations NVD · 118

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*9.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*9.0 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*9.0 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*9.0 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*9.0 r3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*9.0 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*9.0 r3.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*9.0 r3.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*9.0 r3.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*9.0 r4VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:* Versions 9.0 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:* Versions 9.0 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:* Versions 9.0 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:* Versions 9.0 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:* Versions 9.0 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:* Versions 9.0 r3.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:* Versions 9.0 r3.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:* Versions 9.0 r3.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:* Versions 9.0 r4 Vulnerable ·Ivanti
Show 108 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*9.0 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*9.0 r5.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*9.0 r6.0VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*9.1 r11.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*9.1 r11.4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*9.1 r11.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*9.1 r12.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*9.1 r15.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*9.1 r16.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*9.1 r17.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r18.1:*:*:*:*:*:*9.1 r18.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r18.2:*:*:*:*:*:*9.1 r18.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*9.1 r4.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*9.1 r9.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*21.9 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*21.12 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*22.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*22.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*22.3 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*22.4 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*22.4 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*22.6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*22.6 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*22.6 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:r2.1:*:*:*:*:*:*22.6 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*9.0VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*9.0 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*9.0 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*9.0 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*9.0 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*9.0 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*9.0 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*9.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*9.1 r13.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r18.1:*:*:*:*:*:*9.1 r18.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r18.2:*:*:*:*:*:*9.1 r18.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*9.1 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4.3:*:*:*:*:*:*9.1 r4.3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*9.1 r8.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*9.1 r8.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*22.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*22.2 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*22.3 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*22.3 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*22.4 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*22.4 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*22.4 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*22.5 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*22.6 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:-:*:*:*:*:*:*:*not specified by NVDVulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*22.2 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r4:*:*:*:*:*:*22.2 r4VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r5:*:*:*:*:*:*22.2 r5VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r1:*:*:*:*:*:*22.3 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r4:*:*:*:*:*:*22.3 r4VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r1:*:*:*:*:*:*22.4 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r3:*:*:*:*:*:*22.4 r3VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1:*:*:*:*:*:*22.5 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1.2:*:*:*:*:*:*22.5 r1.2VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1:*:*:*:*:*:*22.6 r1VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.2:*:*:*:*:*:*22.6 r1.2VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:* Versions 9.0 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:* Versions 9.0 r5.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:* Versions 9.0 r6.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* Versions 9.1 r11.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* Versions 9.1 r11.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:* Versions 9.1 r11.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:* Versions 9.1 r12.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:* Versions 9.1 r15.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:* Versions 9.1 r16.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:* Versions 9.1 r17.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18.1:*:*:*:*:*:* Versions 9.1 r18.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18.2:*:*:*:*:*:* Versions 9.1 r18.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:* Versions 9.1 r4.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:* Versions 9.1 r9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:* Versions 21.9 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:* Versions 21.12 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:* Versions 22.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:* Versions 22.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:* Versions 22.3 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:* Versions 22.4 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:* Versions 22.6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:* Versions 22.6 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:* Versions 22.6 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:r2.1:*:*:*:*:*:* Versions 22.6 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:* Versions 9.0 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:* Versions 9.0 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:* Versions 9.0 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:* Versions 9.0 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:* Versions 9.0 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:* Versions 9.0 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:* Versions 9.1 r13.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r18.1:*:*:*:*:*:* Versions 9.1 r18.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r18.2:*:*:*:*:*:* Versions 9.1 r18.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:* Versions 9.1 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4.3:*:*:*:*:*:* Versions 9.1 r4.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:* Versions 9.1 r8.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:* Versions 9.1 r8.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:* Versions 22.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:* Versions 22.2 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:* Versions 22.3 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:* Versions 22.3 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:* Versions 22.4 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:* Versions 22.4 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:* Versions 22.5 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:* Versions 22.6 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:* Versions 22.2 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r4:*:*:*:*:*:* Versions 22.2 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r5:*:*:*:*:*:* Versions 22.2 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r1:*:*:*:*:*:* Versions 22.3 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r4:*:*:*:*:*:* Versions 22.3 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r3:*:*:*:*:*:* Versions 22.4 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1:*:*:*:*:*:* Versions 22.5 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1.2:*:*:*:*:*:* Versions 22.5 r1.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1:*:*:*:*:*:* Versions 22.6 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.2:*:*:*:*:*:* Versions 22.6 r1.2 Vulnerable ·Ivanti

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-01-31 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-21893
  3. 2026-10-03 Alias added: GHSA-5rr9-mqhj-7cr2

References

Advisory 1

  • TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
  • TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences