CVE-2024-21887

🔥 Known Exploited (CISA KEV)CRITICAL

9.1

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-01-12

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Affected Platforms (CPE)

📦

Ivanti

Connect Secure

= 9.0= 9.1= 22.1= 22.2= 22.3= 22.4= 22.5= 22.6

📦

Ivanti

Policy Secure

= 9.0= 9.1= 22.1= 22.2= 22.3= 22.4= 22.5= 22.6

References & Advisories

🔗 http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html

🔗 https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US