Skip to content
Back to search

CVE-2024-21887

CRITICAL
9.1 RansomwareNVD

Summary

generated automatically from NVD data

CVE-2024-21887 is a command injection flaw (CWE-77) in the web components of Ivanti Connect Secure and Ivanti Policy Secure, affecting the 9.x and 22.x lines. An authenticated administrator can send specially crafted requests to execute arbitrary commands on the appliance. It carries a CVSS v3.1 score of 9.1 (CRITICAL) and is listed in the CISA KEV catalog, with known use in ransomware campaigns.

NVD description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2024-01-22

Used in known ransomware campaigns.

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

9.1
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Information

Published
12 janv. 2024
Updated
4 août 2026
Status
Analyzed
Source
support@hackerone.com

Affected products

ivanti connect secure
Versions : 9.0, 9.1, 22.1, 22.2, 22.3
ivanti policy secure
Versions : 9.0, 9.1, 22.1, 22.2, 22.3

Weaknesses (CWE)

CWE-77CWE-77

References (5)

Similar CVEs

Other vulnerabilities of type CWE-77

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring