CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-01-10
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-12 · updated 2026-08-04
Weakness: CWE-77

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Affected products

Ivanti Connect Secure (Pulse Secure): 9.0, 9.1-r1, 9.1-r10, 9.1-r11, 9.1-r11.3, 9.1-r11.4 (+38)
Ivanti Policy Secure: 9.0, 9.1-r1, 9.1-r10, 9.1-r11, 9.1-r12, 9.1-r13 (+31)

References

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887

Get alerted when CVE-2024-21887 or the next vulnerability affects your stack