Vulnerabilities/Ivanti/CVE-2024-21893

CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD8.2High
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 31 Jan 2024

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

Recommended action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date 2 Feb 2024 · CWE-918

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
ICS9.1R18 to 9.1R18Unknown
ICS22.6R2 to 22.6R2Unknown
IPS9.1R18 to 9.1R18Unknown
IPS22.6R1 to 22.6R1Unknown
connect_secure9.0Unknown
Show 16 more rows
connect_secure22.6Unknown
policy_secure22.3Unknown
policy_secure22.6Unknown
policy_secure22.5Unknown
policy_secure22.4Unknown
connect_secure22.1Unknown
connect_secure22.2Unknown
connect_secure9.1Unknown
connect_secure21.9Unknown
connect_secure21.12Unknown
policy_secure22.2Unknown
policy_secure22.1Unknown
policy_secure9.1Unknown
connect_secure22.4Unknown
connect_secure22.3Unknown
policy_secure9.0Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 31 Jan 2024 · Added to CISA KEV
  • 2 Feb 2024 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.