CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Published Sep 19, 2024 · updated Jun 17, 2026 · ivanti endpoint manager cloud services appliance
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Timeline
Detection, updates, and resolution for this record.
Sep 19, 2024 · Catalog
Detected
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Sep 19, 2024 · CISA KEV
Known exploited
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Oct 10, 2024 · CISA KEV
Remediation due
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Jun 17, 2026 · Catalog
Updated
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Required action
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
CISA due date Oct 10, 2024
Affected
- cpe ivanti/endpoint manager cloud services appliance4.6
- vendor Ivanti Cloud Services Appliance (CSA)version unspecified
Sources
- CISA KEVCVE-2024-8963
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
cisa.gov - CVE.orgCVE-2024-8963
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-8963
30-day exploitation probability 98.6%
first.org - NIST NVDCVE-2024-8963
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
nvd.nist.gov