9.1

CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CVSS: 9.1v3.0CriticalKEVRansomwareAnalyzed
Published 12-01-2024Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2024-21887 is a critical (CVSS 9.1) Command Injection vulnerability in Ivanti Connect Secure and Policy Secure. It is known to be exploited: CISA lists it, first on 10-01-2024. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.0 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits3reference, metasploit

Timeline

  1. 10-01-2024
    Added to CISA KEVIvanti Connect Secure and Policy Secure Command Injection Vulnerability
  2. 12-01-2024
    PublishedVulnerability first disclosed.
  3. 22-01-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 04-08-2026
    Last modifiedVulnerability information updated.

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 20-09-2026

20-09-202620-10-2026
EPSS score
100.00%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
10-01-2024
Federal due date
22-01-2024
Ransomware

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2024-21887

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Ivanti Connect Secure Unauthenticated Remote Code Execution

    exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    Ivanti Connect Secure Unauthenticated Remote Code Execution

    exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Ivanti4 products
  • connect_secure9.0 | 9.1:r1 | 9.1:r1.0 | 9.1:r11 | 9.1:r11.3 | 9.1:r11.4 | 9.1:r11.5 | 9.1:r12 | 9.1:r12.1 | 9.1:r13 | 9.1:r13.1 | 9.1:r14 | 9.1:r15 | 9.1:r15.2 | 9.1:r16 | 9.1:r16.1 | 9.1:r17 | 9.1:r17.1 | 9.1:r18 | 9.1:r2 | 9.1:r3 | 9.1:r4 | 9.1:r4.1 | 9.1:r4.2 | 9.1:r4.3 | 9.1:r5 | 9.1:r6 | 9.1:r7 | 9.1:r8 | 9.1:r8.1 | 9.1:r8.2 | 9.1:r9 | 9.1:r9.1 | 22.1:r1 | 22.1:r6 | 22.2 | 22.2:r1 | 22.3:r1 | 22.4:r1 | 22.4:r2.1 | 22.5:r2.1 | 22.6 | 22.6:r1 | 22.6:r2
  • ics9.1R18 | 22.6R2
  • ips9.1R18 | 22.6R1
  • policy_secure9.0 | 9.1:r1 | 9.1:r10 | 9.1:r11 | 9.1:r12 | 9.1:r13 | 9.1:r13.1 | 9.1:r14 | 9.1:r15 | 9.1:r16 | 9.1:r17 | 9.1:r18 | 9.1:r2 | 9.1:r3 | 9.1:r3.1 | 9.1:r4 | 9.1:r4.1 | 9.1:r4.2 | 9.1:r5 | 9.1:r6 | 9.1:r7 | 9.1:r8 | 9.1:r8.1 | 9.1:r8.2 | 9.1:r9 | 22.1:r1 | 22.1:r6 | 22.2:r1 | 22.2:r3 | 22.3:r1 | 22.3:r3 | 22.4:r1 | 22.4:r2 | 22.4:r2.1 | 22.5:r1 | 22.5:r2.1 | 22.6:r1

1 vendor · 4 products

References

3 links