CVE-2024-21893: Ivanti Connect Secure SAML SSRF allows unauthenticated resource access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is unauthenticated, network-reachable, listed in CISA KEV with known ransomware use, and has an EPSS probability near 1.0.

What it is

The SAML component of Ivanti Connect Secure, Policy Secure and Neurons for ZTA contains a server-side request forgery flaw that lets an attacker reach restricted resources without authentication. Because the affected products are internet-facing gateways, the flaw matters for perimeter security and was added to CISA KEV with a two-day remediation deadline.

Impact

An unauthenticated attacker can make the appliance issue requests to restricted internal resources, potentially reaching services not otherwise exposed. The CVSS vector rates confidentiality impact as high and integrity impact as low, with no availability impact.

Attack surface

Reachable over the network through the SAML component with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed SAML endpoint on the listed products is in scope.

Exploitation

Listed in CISA KEV on 2024-01-31 with known ransomware campaign use, and EPSS probability is effectively 1.0, indicating active exploitation. No public exploit references are included in the record beyond the vendor advisory and KEV entry.

What to do

• Apply the vendor's patches or prescribed mitigations for the SAML SSRF immediately, per the KEV required action.
• If no mitigation is available, discontinue use of the affected appliance as CISA directs.
• Restrict or monitor external access to SAML endpoints on Connect Secure, Policy Secure and Neurons for ZTA.
• Isolate management and internal interfaces from the internet-facing SAML path to limit SSRF reach.
• Review KEV guidance and vendor advisories for updated remediation steps.

Detection

• Monitor appliance and perimeter logs for anomalous outbound requests originating from the SAML service to internal addresses.
• Alert on SAML endpoint requests from unexpected source IPs or with malformed SAML payloads.
• Correlate appliance egress traffic with internal service access logs for signs of SSRF-driven requests.
• Hunt for post-exploitation activity consistent with KEV-listed ransomware use on affected appliances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.