CyberSec.Space Logo
Back to CVE Browser

CVE-2024-21893

🔥 Known Exploited (CISA KEV)HIGH
8.2
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2024-01-31
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Affected Platforms (CPE)

📦
Ivanti

Connect Secure

= 9.0= 9.1= 21.9= 21.12= 22.1= 22.2= 22.3= 22.4= 22.6
📦
Ivanti

Policy Secure

= 9.0= 9.1= 22.1= 22.2= 22.3= 22.4= 22.5= 22.6
📦
Ivanti

Neurons For Zero Trust Access

All versions= 22.2= 22.3= 22.4= 22.5= 22.6

References & Advisories

🔗 https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
🔗 https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893

Related Vulnerabilities

CVE-2026-64535

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kuma...

CVE-2026-645247.7

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback ...

CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match...

CVE-2026-644599.8

In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit ...