CVE-2024-21887

Timeline

Detection, updates, and resolution for this record.

1. Jan 10, 2024 · Catalog

   Detected

   Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

2. Jan 10, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 22, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Aug 3, 2026 · Catalog

   Updated

   Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

Affected

• cpe ivanti/connect secure9.0
• cpe ivanti/connect secure9.1
• vendor Ivanti Connect Secure and Policy Secureversion unspecified

Sources

• CISA KEVCVE-2024-21887

  Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

  cisa.gov
• CVE.orgCVE-2024-21887

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-21887

  30-day exploitation probability 100.0%

  first.org
• Metasploit Modulesexploit_linux/http/ivanti_connect_secure_rce_cve_2023_46805

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• Metasploit Modulesexploit_linux/http/ivanti_connect_secure_rce_cve_2024_21893

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2024-21887

  A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

  nvd.nist.gov

References

• Exploit · packetstormsecurity.com
• Vendor Advisory · forums.ivanti.com
• CISA note · forums.ivanti.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov