8.2

CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

CVSS: 8.2v3.0HighKEVRansomwareAnalyzed
Published 31-01-2024Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2024-21893 is a high (CVSS 8.2) Server-Side Request Forgery (SSRF) vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons. It is known to be exploited: CISA lists it, first on 31-01-2024. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.0 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits1metasploit

Timeline

  1. 31-01-2024
    PublishedVulnerability first disclosed.
  2. 31-01-2024
    Added to CISA KEVIvanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
  3. 02-02-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 04-08-2026
    Last modifiedVulnerability information updated.

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 19-09-2026

19-09-202619-10-2026
EPSS score
100.00%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
31-01-2024
Federal due date
02-02-2024
Ransomware

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. forums.ivanti.com/s/… nvd.nist.gov/vuln/detail/CVE-2024-21893

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Ivanti Connect Secure Unauthenticated Remote Code Execution

    exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Ivanti5 products
  • connect_secure9.0 | 9.0:r1 | 9.0:r2 | 9.0:r2.1 | 9.0:r3 | 9.0:r3.1 | 9.0:r3.2 | 9.0:r3.3 | 9.0:r3.5 | 9.0:r4 | 9.0:r4.1 | 9.0:r5.0 | 9.0:r6.0 | 9.1:r1 | 9.1:r1.0 | 9.1:r11 | 9.1:r11.3 | 9.1:r11.4 | 9.1:r11.5 | 9.1:r12 | 9.1:r12.1 | 9.1:r13 | 9.1:r13.1 | 9.1:r14 | 9.1:r15 | 9.1:r15.2 | 9.1:r16 | 9.1:r16.1 | 9.1:r17 | 9.1:r17.1 | 9.1:r18 | 9.1:r18.1 | 9.1:r18.2 | 9.1:r2 | 9.1:r3 | 9.1:r4 | 9.1:r4.1 | 9.1:r4.2 | 9.1:r4.3 | 9.1:r5 | 9.1:r6 | 9.1:r7 | 9.1:r8 | 9.1:r8.1 | 9.1:r8.2 | 9.1:r9 | 9.1:r9.1 | 21.9:r1 | 21.12:r1 | 22.1:r1 | 22.1:r6 | 22.2 | 22.2:r1 | 22.3:r1 | 22.4:r1 | 22.4:r2.1 | 22.6 | 22.6:r1 | 22.6:r2 | 22.6:r2.1
  • ics9.1R18 | 22.6R2
  • ips9.1R18 | 22.6R1
  • neurons_for_zero-trust_accessna | 22.2:r1 | 22.2:r4 | 22.2:r5 | 22.3:r1 | 22.3:r4 | 22.4:r1 | 22.4:r3 | 22.5:r1 | 22.5:r1.2 | 22.6:r1 | 22.6:r1.2
  • policy_secure9.0 | 9.0:r1 | 9.0:r2 | 9.0:r2.1 | 9.0:r3 | 9.0:r3.1 | 9.0:r4 | 9.1 | 9.1:r1 | 9.1:r10 | 9.1:r11 | 9.1:r12 | 9.1:r13 | 9.1:r13.1 | 9.1:r14 | 9.1:r15 | 9.1:r16 | 9.1:r17 | 9.1:r18 | 9.1:r18.1 | 9.1:r18.2 | 9.1:r2 | 9.1:r3 | 9.1:r3.1 | 9.1:r4 | 9.1:r4.1 | 9.1:r4.2 | 9.1:r4.3 | 9.1:r5 | 9.1:r6 | 9.1:r7 | 9.1:r8 | 9.1:r8.1 | 9.1:r8.2 | 9.1:r9 | 22.1:r1 | 22.1:r6 | 22.2:r1 | 22.2:r3 | 22.3:r1 | 22.3:r3 | 22.4:r1 | 22.4:r2 | 22.4:r2.1 | 22.5:r1 | 22.6:r1

1 vendor · 5 products

References

2 links