Vulnerabilities/Ivanti/CVE-2024-21887
CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 22 Jan 2024 · CWE-77
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| ICS | 9.1R18 to 9.1R18 | Unknown |
| ICS | 22.6R2 to 22.6R2 | Unknown |
| IPS | 9.1R18 to 9.1R18 | Unknown |
| IPS | 22.6R1 to 22.6R1 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 10 Jan 2024 · Added to CISA KEV
- 22 Jan 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.