{"id":"CVE-2024-21887","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-21887","generatedAt":"2026-10-28T14:18:38.495Z","title":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","description":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","published":"2024-01-12T17:15:10.000Z","lastModified":"2026-08-04T05:16:30.000Z","status":"Analyzed","sourceIdentifier":"support@hackerone.com","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-77"],"affected":["ivanti/connect secure","ivanti/policy secure"],"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2024-01-10","dueDate":"2024-01-22","knownRansomwareCampaignUse":"Known","notes":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\nPlease apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 22 January 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"support@hackerone.com"},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"],"source":"support@hackerone.com"},{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-21887","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}