CVE-2024-21887

Critical9.1 Published on Jan 12, 2024

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jan 10, 2024
US federal agencies must remediate it by Jan 22, 2024 (BOD 22-01)
Attacked 3 days before the vulnerability was made public
Confirmed by sensors, not only by reports
Used in ransomware campaigns

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-77, CWE-77

Vendorsivanti

Affected products

Vendors	Product	Versions
ivanti	connect secure	9.0
ivanti	policy secure	9.0

Vulnerabilities

BeyondTrust Remote Support Zero-Day Exploited Against Hosted and Self-Hosted Appliances

BeyondTrust Remote Support zero-day exploited in hosted and self-hosted appliances, enabling file operations and root access, linked to Armory Castle.

Oct 16, 202614:40 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database