Read the docs
TI-2024-14645 Aliases CVE-2024-22024GHSA-cmg9-p9gp-g7mr

XML external entity injection in Ivanti ICS

Priority CRITICAL 86CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.94721 99th percentileScored 2026-11-07
Fix Fixed ICS (Ivanti): 9.1R14.5, 9.1R17.3, 9.1R18.4 +18ICS (Ivant ): 9.1R15.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiICS9.1R14.5 to before 9.1R14.5; 9.1R17.3 to before 9.1R17.3; 9.1R18.4 to before 9.1R18.4; 22.1R6.1 to before 22.1R6.1; 22.2R4.1 to before 22.2R4.1; 22.3R1.1 to before 22.3R1.1; 22.4R1.1 to before 22.4R1.1; 22.5R1.2 to before 22.5R1.2; 22.6R1.1 to before 22.6R1.1; 22.4R2.3 to before 22.4R2.3; 22.5R2.3 to before 22.5R2.3; 22.6R2.2 to before 22.6R2.29.1R14.5, 9.1R17.3, 9.1R18.4, 22.1R6.1, 9.1R14.4, 9.1R15.2, 9.1R16.2, 9.1R17.2, 9.1R18.3, 22.2R4.1, 22.3R1.1, 22.4R1.1, 22.5R1.2, 22.6R1.1, 22.4R2.3, 22.5R2.3, 22.6R2.2, 22.3R1, 22.5R1.1, 22.4R2.2, 22.5R2.2Patch availableCNA
Ivant ICS9.1R15.3 to before 9.1R15.39.1R15.3Patch availableCNA
IvantiIPS9.1R18.4 to before 9.1R18.4; 9.1R17.3 to before 9.1R17.3; 22.5R1.2 to before 22.5R1.29.1R18.4, 9.1R17.3, 22.5R1.2, 9.1R18.2, 9.1R17.2, 22.5R1.1Patch availableCNA
  • ICS VendorIvanti Affected 9.1R14.5 to before 9.1R14.5; 9.1R17.3 to before 9.1R17.3; 9.1R18.4 to before 9.1R18.4; 22.1R6.1 to before 22.1R6.1; 22.2R4.1 to before 22.2R4.1; 22.3R1.1 to before 22.3R1.1; 22.4R1.1 to before 22.4R1.1; 22.5R1.2 to before 22.5R1.2; 22.6R1.1 to before 22.6R1.1; 22.4R2.3 to before 22.4R2.3; 22.5R2.3 to before 22.5R2.3; 22.6R2.2 to before 22.6R2.2 Fixed in 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.1R6.1, 9.1R14.4, 9.1R15.2, 9.1R16.2, 9.1R17.2, 9.1R18.3, 22.2R4.1, 22.3R1.1, 22.4R1.1, 22.5R1.2, 22.6R1.1, 22.4R2.3, 22.5R2.3, 22.6R2.2, 22.3R1, 22.5R1.1, 22.4R2.2, 22.5R2.2 Patch available CNA
  • ICS VendorIvant Affected 9.1R15.3 to before 9.1R15.3 Fixed in 9.1R15.3 Patch available CNA
  • IPS VendorIvanti Affected 9.1R18.4 to before 9.1R18.4; 9.1R17.3 to before 9.1R17.3; 22.5R1.2 to before 22.5R1.2 Fixed in 9.1R18.4, 9.1R17.3, 22.5R1.2, 9.1R18.2, 9.1R17.2, 22.5R1.1 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:connect_secure:9.1:r14.4:*:*:*:*:*:*9.1 r14.4VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r17.2:*:*:*:*:*:*9.1 r17.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:9.1:r18.3:*:*:*:*:*:*9.1 r18.3VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.4:r2.2:*:*:*:*:*:*22.4 r2.2VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.5:r1.1:*:*:*:*:*:*22.5 r1.1VulnerableIvanti
cpe:2.3:a:ivanti:connect_secure:22.5:r2.2:*:*:*:*:*:*22.5 r2.2VulnerableIvanti
cpe:2.3:a:ivanti:policy_secure:22.5:r1.1:*:*:*:*:*:*22.5 r1.1VulnerableIvanti
cpe:2.3:a:ivanti:zero_trust_access_gateway:22.6:r1.3:*:*:*:*:*:*22.6 r1.3VulnerableIvanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r14.4:*:*:*:*:*:* Versions 9.1 r14.4 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r17.2:*:*:*:*:*:* Versions 9.1 r17.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:9.1:r18.3:*:*:*:*:*:* Versions 9.1 r18.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.4:r2.2:*:*:*:*:*:* Versions 22.4 r2.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.5:r1.1:*:*:*:*:*:* Versions 22.5 r1.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:connect_secure:22.5:r2.2:*:*:*:*:*:* Versions 22.5 r2.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:policy_secure:22.5:r1.1:*:*:*:*:*:* Versions 22.5 r1.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:zero_trust_access_gateway:22.6:r1.3:*:*:*:*:*:* Versions 22.6 r1.3 Vulnerable ·Ivanti

Remediation

  • Fix · CNA ICS (Ivanti) Fixed in 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.1R6.1, 9.1R14.4, 9.1R15.2, 9.1R16.2, 9.1R17.2, 9.1R18.3, 22.2R4.1, 22.3R1.1, 22.4R1.1, 22.5R1.2, 22.6R1.1, 22.4R2.3, 22.5R2.3, 22.6R2.2, 22.3R1, 22.5R1.1, 22.4R2.2, 22.5R2.2
  • Fix · CNA ICS (Ivant ) Fixed in 9.1R15.3
  • Fix · CNA IPS (Ivanti) Fixed in 9.1R18.4, 9.1R17.3, 22.5R1.2, 9.1R18.2, 9.1R17.2, 22.5R1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22024
  2. 2026-10-03 Alias added: GHSA-cmg9-p9gp-g7mr

References

Advisory 1

  • TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05754 Improper authentication in Pulse Connect Secure KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-08600 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and… KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-00226 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.0
  • TI-2024-14549 Command injection in Ivanti ICS KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-05760 Command injection in Pulse Connect Secure KEVCVSS 3.1HIGH 8.8
See all 132 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences