Summary
generated automatically from NVD dataIvanti vTM (virtual Traffic Manager) contains an incorrect implementation of an authentication algorithm, classified as CWE-287, that lets a remote unauthenticated attacker bypass authentication on the admin panel. The description says versions other than 22.2R1 or 22.7R2 are affected. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 and is listed in the CISA KEV catalog, meaning it is actively exploited.
NVD description
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-24. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2024-10-15
EPSS · FIRST.org
100.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 13 août 2024
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Affected products
Weaknesses (CWE)
References (2)
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593MitigationPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-287
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.