CVE-2024-22024: Ivanti Connect Secure SAML XXE allows unauthenticated resource access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable XXE with a very high EPSS score, though not in KEV and with only low-rated direct impact.

What it is

The SAML component of Ivanti Connect Secure, Policy Secure and ZTA gateways is vulnerable to XML external entity (XXE) injection (CWE-611). An attacker can craft XML that causes the server to resolve external entities, exposing restricted resources. Because the flaw sits in a pre-authentication SAML path, it is reachable without credentials and carries a high EPSS score, making it a realistic target for mass scanning.

Impact

An attacker gains read access to certain restricted resources on the appliance without authenticating. The CVSS vector rates confidentiality, integrity and availability impact as low but scope-changing, so the exposure extends beyond the vulnerable component.

Attack surface

Reached over the network via the SAML endpoint; the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description confirms unauthenticated access to restricted resources.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.947 probability, 99.85th percentile), indicating elevated likelihood of exploitation. The only references are vendor advisories, so no public exploit details are confirmed in this record.

What to do

• Apply the vendor patch from the Ivanti advisory for Connect Secure, Policy Secure and ZTA gateways.
• If patching is delayed, restrict network access to the SAML endpoint to trusted sources only.
• Disable or limit external entity resolution in the SAML/XML parser where configuration allows.
• Monitor Ivanti advisories for updated fixed versions and any workaround guidance.
• Audit appliances for signs of prior compromise before and after remediation.

Detection

• Inspect SAML request bodies for DOCTYPE declarations or external entity references.
• Alert on outbound connections from the appliance to unexpected hosts following SAML requests.
• Review appliance logs for anomalous SAML endpoint access from untrusted source IPs.
• Correlate high-volume scanning of the SAML path with subsequent file or resource access anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.