What’s Vulnerable › Vulnerabilities
CVE-2024-37404
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 71.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-10-18 · updated 2026-06-17
Description
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
Affected products
- Ivanti Connect Secure (Pulse Secure): before 9.1; from 22.3 before 22.7; 9.1-r1, 9.1-r10, 9.1-r10.2, 9.1-r11, 9.1-r11.0, 9.1-r11.1 (+48) — fixed in 22.7, 9.1
- Ivanti Policy Secure: before 22.7; 22.7, 22.7-r1 — fixed in 22.7
How to fix
Upgrade to a fixed version: Ivanti Connect Secure (Pulse Secure) 22.7, 9.1; Ivanti Policy Secure 22.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-37404 or the next vulnerability affects your stack