Read the docs
TI-2024-14644 Aliases CVE-2024-22023GHSA-mfj7-pc34-cqm8

NULL pointer dereference in Ivanti Connect Secure

Priority LOW 36CWE-703Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03 87th percentileScored 2026-11-07
Fix Fixed Connect Secure (Ivanti): 22.1R6.2, 22.2R4.2, 22.3R1.2 +10Policy Secure (Ivanti): 22.4R1.2, 22.5R1.3, 22.6R1.2 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiConnect Secure22.1R6.2 to before 22.1R6.2; 22.2R4.2 to before 22.2R4.2; 22.3R1.2 to before 22.3R1.2; 22.4R1.2 to before 22.4R1.2; 22.4R2.4 to before 22.4R2.4; 22.5R1.3 to before 22.5R1.3; 22.5R2.4 to before 22.5R2.4; 22.6R2.3 to before 22.6R2.3; 9.1R14.6 to before 9.1R14.6; 9.1R15.4 to before 9.1R15.4; 9.1R16.4 to before 9.1R16.4; 9.1R17.4 to before 9.1R17.4; 9.1R18.5 to before 9.1R18.522.1R6.2, 22.2R4.2, 22.3R1.2, 22.4R1.2, 22.4R2.4, 22.5R1.3, 22.5R2.4, 22.6R2.3, 9.1R14.6, 9.1R15.4, 9.1R16.4, 9.1R17.4, 9.1R18.5Patch availableCNA
IvantiPolicy Secure22.4R1.2 to before 22.4R1.2; 22.5R1.3 to before 22.5R1.3; 22.6R1.2 to before 22.6R1.2; 9.1R16.4 to before 9.1R16.4; 9.1R17.4 to before 9.1R17.4; 9.1R18.5 to before 9.1R18.522.4R1.2, 22.5R1.3, 22.6R1.2, 9.1R16.4, 9.1R17.4, 9.1R18.5Patch availableCNA
  • Connect Secure VendorIvanti Affected 22.1R6.2 to before 22.1R6.2; 22.2R4.2 to before 22.2R4.2; 22.3R1.2 to before 22.3R1.2; 22.4R1.2 to before 22.4R1.2; 22.4R2.4 to before 22.4R2.4; 22.5R1.3 to before 22.5R1.3; 22.5R2.4 to before 22.5R2.4; 22.6R2.3 to before 22.6R2.3; 9.1R14.6 to before 9.1R14.6; 9.1R15.4 to before 9.1R15.4; 9.1R16.4 to before 9.1R16.4; 9.1R17.4 to before 9.1R17.4; 9.1R18.5 to before 9.1R18.5 Fixed in 22.1R6.2, 22.2R4.2, 22.3R1.2, 22.4R1.2, 22.4R2.4, 22.5R1.3, 22.5R2.4, 22.6R2.3, 9.1R14.6, 9.1R15.4, 9.1R16.4, 9.1R17.4, 9.1R18.5 Patch available CNA
  • Policy Secure VendorIvanti Affected 22.4R1.2 to before 22.4R1.2; 22.5R1.3 to before 22.5R1.3; 22.6R1.2 to before 22.6R1.2; 9.1R16.4 to before 9.1R16.4; 9.1R17.4 to before 9.1R17.4; 9.1R18.5 to before 9.1R18.5 Fixed in 22.4R1.2, 22.5R1.3, 22.6R1.2, 9.1R16.4, 9.1R17.4, 9.1R18.5 Patch available CNA

CPE configurations NVD · 60

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*9.1 r11.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:lts:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:* Versions 9.1 r11.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:lts:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
Show 50 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*9.1 r4.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*9.1 r4.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*9.1 r4.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*22.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*22.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.3:*:*:*:*:*:*:*22.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*22.4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.5:*:*:*:*:*:*:*22.5VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*22.6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*9.0VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*9.0 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*9.0 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*9.0 r2.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*9.0 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*9.0 r3.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*9.0 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*9.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*9.1 r1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*9.1 r10VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*9.1 r11VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*9.1 r12VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*9.1 r13VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*9.1 r14VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*9.1 r15VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*9.1 r16VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*9.1 r17VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*9.1 r18VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*9.1 r2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*9.1 r3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*9.1 r4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*9.1 r5VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*9.1 r6VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*9.1 r7VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*9.1 r8VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*9.1 r9VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*22.1VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*22.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*22.3VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*22.4VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*22.5VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.6:*:*:*:*:*:*:*22.6VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:* Versions 9.1 r4.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:* Versions 9.1 r4.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:* Versions 9.1 r4.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:* Versions 22.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:* Versions 22.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.3:*:*:*:*:*:*:* Versions 22.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:* Versions 22.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.5:*:*:*:*:*:*:* Versions 22.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:* Versions 22.6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:* Versions 9.0 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:* Versions 9.0 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:* Versions 9.0 r2.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:* Versions 9.0 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:* Versions 9.0 r3.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:* Versions 9.0 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:* Versions 9.1 r10 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:* Versions 9.1 r11 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:* Versions 9.1 r12 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:* Versions 9.1 r13 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:* Versions 9.1 r14 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:* Versions 9.1 r15 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:* Versions 9.1 r16 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:* Versions 9.1 r17 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:* Versions 9.1 r18 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:* Versions 9.1 r3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:* Versions 9.1 r4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:* Versions 9.1 r5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:* Versions 9.1 r6 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:* Versions 9.1 r7 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:* Versions 9.1 r8 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:* Versions 9.1 r9 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:* Versions 22.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:* Versions 22.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:* Versions 22.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:* Versions 22.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:* Versions 22.5 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.6:*:*:*:*:*:*:* Versions 22.6 Vulnerable ·Ivanti

Remediation

  • Fix · CNA Connect Secure (Ivanti) Fixed in 22.1R6.2, 22.2R4.2, 22.3R1.2, 22.4R1.2, 22.4R2.4, 22.5R1.3, 22.5R2.4, 22.6R2.3, 9.1R14.6, 9.1R15.4, 9.1R16.4, 9.1R17.4, 9.1R18.5
  • Fix · CNA Policy Secure (Ivanti) Fixed in 22.4R1.2, 22.5R1.3, 22.6R1.2, 9.1R16.4, 9.1R17.4, 9.1R18.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ivanti Connect Secure 22.1R6.2, 22.2R4.2 and 11 more versions

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-14555 Out-of-bounds write in Ivanti Connect SecurePriority HIGH 66
    • TI-2024-14671 Out-of-bounds write in Ivanti Connect SecurePriority MEDIUM 50
    • TI-2024-14670 NULL pointer dereference in Ivanti Connect SecurePriority MEDIUM 45
    Show all 4 records →
  • Release ·

    Ivanti Policy Secure 22.4R1.2, 22.5R1.3 and 4 more versions

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-14671 Out-of-bounds write in Ivanti Connect SecurePriority MEDIUM 50
    • TI-2024-14670 NULL pointer dereference in Ivanti Connect SecurePriority MEDIUM 45
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22023
  2. 2026-10-03 Alias added: GHSA-mfj7-pc34-cqm8

References

Advisory 1

  • TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
  • TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences