ZeroDay Findings
Sign inSign up

Findings

CVE-2021-44529

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

Published Dec 8, 2021 · updated Aug 3, 2026 · ivanti endpoint manager cloud services appliance

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

Timeline

Detection, updates, and resolution for this record.

  1. Dec 8, 2021 · Catalog

    Detected

    Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

  2. Mar 25, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Apr 15, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 3, 2026 · Catalog

    Updated

    Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Apr 15, 2024

Affected

  • cpe ivanti/endpoint manager cloud services applianceversion unspecified
  • cpe ivanti/endpoint manager cloud services appliance4.6
  • vendor Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)version unspecified

Sources

  • CISA KEVCVE-2021-44529

    Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

    cisa.gov
  • CVE.orgCVE-2021-44529

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-44529

    30-day exploitation probability 99.1%

    first.org
  • Exploit Database50833

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/ivanti_csa_unauth_rce_cve_2021_44529

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-44529

    A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References