Vulnerability record · CVE-2024-7593 · published 13 August 2024
CVE-2024-7593: Ivanti vTM authentication bypass in admin panel
Ivanti · Virtual Traffic Manager
Ivanti Virtual Traffic Manager (vTM) versions other than 22.2R1 or 22.7R2 implement an authentication algorithm incorrectly, allowing an attacker to bypass admin panel authentication. The flaw is remotely reachable and requires no credentials, making it a direct path to the management interface.
Description
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, unauthenticated remote admin bypass, CISA KEV listing and near-certain EPSS probability make this an urgent patch-first vulnerability.
What it is
Ivanti Virtual Traffic Manager (vTM) versions other than 22.2R1 or 22.7R2 implement an authentication algorithm incorrectly, allowing an attacker to bypass admin panel authentication. The flaw is remotely reachable and requires no credentials, making it a direct path to the management interface.
Impact
An unauthenticated attacker gains full access to the vTM admin panel, which can lead to complete compromise of confidentiality, integrity and availability of the managed traffic infrastructure.
Attack surface
Reachable over the network via the admin panel; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-24, and EPSS gives a 30-day probability of 0.9999, indicating active exploitation is expected or observed.
What to do
- Upgrade Ivanti vTM to 22.2R1 or 22.7R2 as directed by the vendor advisory.
- If immediate patching is not possible, apply the vendor's documented mitigations or discontinue use of the product per CISA guidance.
- Restrict network access to the vTM admin panel to trusted management networks only.
- Audit admin accounts and credentials for signs of unauthorized access or modification.
- Monitor for and block exploitation attempts at the network perimeter.
Detection
- Review vTM admin panel logs for authentication bypass patterns or unexpected successful logins from untrusted sources.
- Monitor network traffic to the vTM admin interface for anomalous access attempts.
- Check for unauthorized configuration changes or new administrative accounts on vTM instances.
- Correlate vTM access logs with known exploitation indicators from vendor and CISA advisories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-7593 to the Known Exploited Vulnerabilities catalog on 24 September 2024 as "Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 15 October 2024.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 | MitigationPatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593 | US Government Resource |
Track CVE-2024-7593 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-7593), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
