Ivanti vTM
CVE-2024-7593
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed vTM admin panel
-
DeliverySend crafted authentication request
-
ExploitBypass authentication algorithm
-
ExecutionGain administrative session
-
PersistReconfigure load balancer or intercept traffic
-
ImpactPivot to backend services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Ivanti vTM administrative panel and that the appliance runs any version other than 22.2R1 or 22.7R2 (vulnerable builds include 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1, 22.7R1). No authentication, no user interaction, and no special configuration toggle is required - the flaw is in the admin authentication algorithm itself (CVSS AV:N/AC:L/PR:N/UI:N). The principal limiting factor is exposure of the admin interface: deployments that follow Ivanti's guidance and restrict the management interface to trusted internal networks via the Management IP ACL are not reachable by an external unauthenticated attacker, which substantially constrains real-world exploitability to environments where the admin panel is internet-exposed or reachable from a compromised internal foothold. |
| Impact | Every available signal points to top-tier priority. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated path to full confidentiality, integrity, and availability compromise. EPSS at 94.44% (100th percentile) indicates exploitation is overwhelmingly likely or already widespread, and this aligns with the confirmed CISA KEV listing, so this is not a high-CVSS-but-low-real-risk case - it is real, ongoing exploitation. The only caveat is exposure scope: vTM admin panels should not be internet-reachable per Ivanti's own guidance, so organizations that have properly restricted the management interface face a markedly reduced (though not zero) attack surface compared to those that exposed it externally. No signals conflict in this case. |
| Exploit ScenarioDerived | An attacker who can reach an exposed vTM admin panel sends a crafted authentication request that the flawed verification algorithm accepts without valid credentials, granting administrative access to the load balancer. From there the attacker reconfigures virtual servers, intercepts or redirects traffic flowing through the ADC, harvests TLS material or backend credentials, or pivots into protected internal services. Given the KEV listing and 94.44% EPSS, this scenario is not hypothetical - exploitation is occurring against internet-reachable instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Authentication bypass in Ivanti Virtual Traffic Manager (vTM) admin panel allows remote unauthenticated attackers to gain administrative access to the appliance due to a flawed authentication algorithm implementation. The flaw is confirmed actively exploited (CISA KEV) with an EPSS score of 94.44% (100th percentile), placing it among the highest-risk vulnerabilities currently tracked. All vTM releases other than 22.2R1 and 22.7R2 are affected.
RemediationAI
Vendor-released patch: upgrade Ivanti vTM to 22.2R1, 22.7R2, or later fixed builds (22.3R3, 22.5R2, 22.6R2 per Ivanti's advisory family) as the primary fix. Until patching is complete, the most effective compensating control is to restrict access to the admin interface by binding management to an internal-only interface and using the built-in Management IP Address ACL to deny untrusted networks; this materially reduces exposure but requires that operators retain a trusted path for legitimate administration. Network-layer controls (firewall rules, VPN-only access, or jump host enforcement) on the admin port should also be applied, with the trade-off that any misconfiguration of these controls can lock out legitimate administrators. Review admin-account activity, session logs, and any unexpected administrative changes for indicators of prior compromise, since the flaw has been actively exploited.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ivanti Virtual Traffic Manager is a software-based application delivery controller (ADC) and load balancer historically known as Pulse Secure Virtual Traffic Manager and originally Brocade/Riverbed Stingray. The admin panel exposes a web-based management interface that should require strong authentication. CWE-287 (Improper Authentication) here manifests as an incorrect implementation of the authentication algorithm itself - meaning the verification logic can be coerced into accepting requests that should be rejected, rather than a missing check or credential leak. Based on the CPE list, affected builds include 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1, and 22.7R1; the fixed builds are 22.2R1 and 22.7R2 per the description.
Know when Ivanti gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Executive ViewAI
Ivanti Virtual Traffic Manager (vTM) is vulnerable to a critical unauthenticated remote authentication bypass that is confirmed actively exploited (CISA KEV), enabling attackers to gain full administrative control of network appliances and directly threaten application delivery infrastructure security.
Apply vendor patch (vTM 22.2R1 or 22.7R2). Interim mitigations: restrict network access to admin interfaces through firewall segmentation; enable comprehensive logging and real-time alerting on all administrative access attempts.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administra
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut
Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated a
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated acc
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to a
Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that al
Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA
GitHub PoC
Exploit-DB