CVE-2024-8963

CRITICAL9.4Published on September 19, 2024

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Sep 19, 2024
US federal agencies must remediate it by Oct 10, 2024 (BOD 22-01)
Attacked 1 day before the vulnerability was made public
Confirmed by sensors, not only by reports

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Source: CISA KEV · Sep 1, 2026 Sep 1, 2026 Aug 31, 2026 Aug 30, 2026 Aug 30, 2026 Aug 29, 2026

CVSS score9.4 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness type (CWE)CWE-22, CWE-22

Vendorsivanti

Affected products

Vendors	Prodotto	Versioni
ivanti	endpoint manager cloud services appliance	4.6

FBI interrompe QScan e QTRouter, la rete cinese che nascondeva gli attacchi alle infrastrutture Usa

APT

FBI Disrupts QScan and QTRouter, the Chinese Network That Hid Attacks on US Infrastructure

FBI disrupts Chinese hacking platforms QScan and QTRouter used to attack US critical infrastructure, including NASA and Federal Reserve.

Aug 27, 20266 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

FBI Disrupts QScan and QTRouter, the Chinese Network That Hid Attacks on US Infrastructure