CVE-2024-8963: Ivanti CSA path traversal allows unauthenticated access to restricted functions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.1, unauthenticated network-reachable path traversal, active exploitation per CISA KEV, and EPSS above 98%, with no patch available for the end-of-life 4.6.x line.

What it is

Ivanti Cloud Services Appliance (CSA) before 4.6 Patch 519 contains a path traversal flaw (CWE-22) that lets a remote, unauthenticated attacker reach restricted functionality. The vulnerability is rated critical (CVSS 9.1) and is listed in CISA's Known Exploited Vulnerabilities catalog, so it should be treated as actively targeted. Because CSA 4.6.x is end-of-life, remediation options are limited to upgrading or removing the appliance.

Impact

An attacker can bypass access controls and reach restricted functionality without credentials, potentially exposing sensitive data or enabling follow-on compromise of the appliance. The CVSS vector shows high confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via HTTP/HTTPS on the CSA appliance; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Any internet-exposed CSA 4.6.x instance is directly at risk.

Exploitation

CVE-2024-8963 is in CISA's KEV catalog (added 2024-09-19, due 2024-10-10) and has an EPSS 30-day probability of 0.986 (99.9th percentile), indicating observed exploitation and very high likelihood of attempted exploitation. No ransomware campaign use is documented in the record.

What to do

• Upgrade CSA to the 5.0.x supported line, or remove CSA 4.6.x from service entirely, since 4.6.x is end-of-life and will not receive further security updates.
• If immediate removal or upgrade is not possible, restrict network access to the CSA management interface to trusted IPs and disable internet exposure.
• Monitor Ivanti's advisory page for any interim guidance or patches for the 4.6.x line.
• Audit for unauthorized configuration changes or new administrative accounts on CSA appliances.
• Apply the CISA KEV required action by the 2024-10-10 due date.

Detection

• Review CSA appliance logs for anomalous path traversal patterns (e.g., ../ sequences) in HTTP requests to restricted endpoints.
• Alert on unauthenticated requests reaching administrative or restricted CSA functionality from unexpected source IPs.
• Monitor for post-exploitation indicators such as new accounts, modified configurations, or outbound connections from the CSA appliance.
• Correlate network traffic to CSA appliances with threat intelligence feeds for CVE-2024-8963 exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.