Connect Secure
CVE-2024-21887
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.1, EPSS 94.4%). This is the code execution component of the January 2024 Ivanti exploitation wave. Together with CVE-2023-46805, it enabled mass compromise of VPN appliances worldwide. |
| Exploit ScenarioDerived | An attacker first bypasses authentication using CVE-2023-46805, then injects OS commands through the admin web interface. The commands execute as root, enabling deployment of web shells, credential harvesting, and lateral movement into connected networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administrators to execute arbitrary commands, chained with CVE-2023-46805 for unauthenticated RCE.
Earlier versions of this analysis (1)
A command injection vulnerability in Ivanti ICS/Policy Secure web components allows authenticated administrators to execute arbitrary commands. When chained with the authentication bypass (CVE-2023-46805), this becomes unauthenticated RCE.
RemediationAI
Apply Ivanti patches. Factory reset recommended before patching. Rotate all credentials that were accessible through the VPN appliance. Monitor for persistent access attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-77 command injection in web management components allows injecting OS commands through specially crafted HTTP requests. While requiring admin authentication standalone, the chain with CVE-2023-46805 provides the authentication bypass needed for unauthenticated exploitation.
Know when Connect Secure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Executive ViewAI
CVE-2024-21887 presents critical security risk, a command injection vulnerability rated CVSS 9.1. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)NVD
More in Connect Secure
View allIvanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated a
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated acc
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated
Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA
Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windo
Privilege escalation to root on Ivanti Connect Secure 22.8R2.4, where the dsinvoked broker improperly trusts DSCache con
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Se
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an
GitHub PoC
Exploit-DB