CVE-2024-21887: Ivanti Connect Secure and Policy Secure web component command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.1, active exploitation in CISA KEV with ransomware use, and near-maximum EPSS make this an urgent edge-device risk.

What it is

Ivanti Connect Secure and Policy Secure (9.x, 22.x) contain a command injection flaw (CWE-77) in web components. An authenticated administrator can send specially crafted requests to execute arbitrary commands on the appliance. Because these are edge VPN gateways, compromise gives attackers a foothold inside the network.

Impact

An attacker with administrative access can execute arbitrary commands on the appliance, leading to full compromise of the gateway and potential lateral movement into internal networks.

Attack surface

Reachable over the network via the web interface (AV:N, AC:L, PR:H, UI:N). The CVSS vector requires high privileges, so authentication as an administrator is needed; no user interaction is required.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is near 1.0 (0.99999). Public exploit code is referenced (Packet Storm), and it is chained with CVE-2023-46805 authentication bypass for unauthenticated remote code execution.

What to do

• Apply the vendor patch or mitigation per Ivanti's advisory immediately; if no fix is available, discontinue use of the product as CISA directs.
• Isolate or restrict management and web interface access to trusted networks and administrative IPs.
• Reset administrator credentials and review accounts for unauthorized changes after suspected exposure.
• Monitor Ivanti advisories and CISA KEV for updated guidance and apply any follow-up patches.
• Consider temporarily disabling or removing the appliance from the internet if it cannot be patched.

Detection

• Inspect web server and appliance logs for crafted requests targeting web components, especially unusual command-like parameters.
• Hunt for unexpected child processes or command execution spawned by the web service on the appliance.
• Monitor for outbound connections or file changes on the appliance consistent with post-exploitation activity.
• Correlate with CVE-2023-46805 authentication bypass attempts in logs to detect chained exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.