CVE-2024-7593

Timeline

Detection, updates, and resolution for this record.

1. Aug 13, 2024 · Catalog

   Detected

   Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

2. Sep 24, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Oct 15, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Affected

• cpe ivanti/virtual traffic manager22.2
• cpe ivanti/virtual traffic manager22.3
• cpe ivanti/virtual traffic manager22.5
• cpe ivanti/virtual traffic manager22.6
• cpe ivanti/virtual traffic manager22.7
• vendor Ivanti Virtual Traffic Managerversion unspecified

Sources

• CISA KEVCVE-2024-7593

  Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

  cisa.gov
• CVE.orgCVE-2024-7593

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-7593

  30-day exploitation probability 100.0%

  first.org
• Metasploit Modulesauxiliary_admin/http/ivanti_vtm_admin

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2024-7593

  Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

  nvd.nist.gov

References

• CISA note · forums.ivanti.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov