CVE-2021-44529

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

Affected

Ivanti EPM

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

99.11% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-03-25, used in ransomware campaigns

Nuclei

critical · CWE-94

Published

2021-12-08

Updated

2026-08-04

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Co…
• http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-I…
• jax7sec/CVE-2021-445292★ · 2022-04-16
• jkana/CVE-2021-445295★ · 2022-03-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44529.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_csa_unauth_rce…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50833

Security advisories

• https://forums.ivanti.com/s/article/SA-2021-12-02

References

• CVE Record
• NVD entry

Related

• CVE-2017-9841
• CVE-2021-31805
• CVE-2022-22954