CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Published Jan 31, 2024 · updated Aug 3, 2026 · ivanti connect secure
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Timeline
Detection, updates, and resolution for this record.
Jan 31, 2024 · Catalog
Detected
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Jan 31, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Feb 2, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 3, 2026 · Catalog
Updated
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Feb 2, 2024
Affected
- cpe ivanti/connect secure9.0
- cpe ivanti/neurons for zero-trust accessversion unspecified
- vendor Ivanti Connect Secure, Policy Secure, and Neuronsversion unspecified
Sources
- CISA KEVCVE-2024-21893
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
cisa.gov - CVE.orgCVE-2024-21893
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-21893
30-day exploitation probability 100.0%
first.org - Metasploit Modulesexploit_linux/http/ivanti_connect_secure_rce_cve_2024_21893
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-21893
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
nvd.nist.gov