What is the CVSS score of CVE-2024-21893?

CVE-2024-21893 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 94.3%.

Which versions of Connect Secure are affected by CVE-2024-21893?

CVE-2024-21893 presents notable security risk, a server-side request forgery vulnerability rated CVSS 8.2.

Is there a public PoC exploit available for CVE-2024-21893?

Yes, a public proof-of-concept exploit is available for CVE-2024-21893. Prioritise patching immediately. EPSS: 94.3%.

How to fix or mitigate CVE-2024-21893?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Implement egress filtering and URL validation for server-side requests.

Connect Secure CVE-2024-21893

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2024-01-31 support@hackerone.com

Ivanti SSRF Connect Secure Policy Secure Neurons For Zero Trust Access

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:20 vuln.today

Added to CISA KEV

Oct 30, 2025 - 20:40 cisa

CISA KEV

CVE Published

Jan 31, 2024 - 18:15 nvd

HIGH 8.2

DescriptionNVD

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

AnalysisAI

Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis.

Technical ContextAI

The CWE-918 SSRF in the SAML authentication component allows attackers to make the Ivanti appliance send requests to internal services. This provides an alternative authentication bypass path to CVE-2023-46805 for reaching the command injection endpoint.