CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v3.0

9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

100.00% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-01-10, used in ransomware campaigns

Nuclei

critical · CWE-77

Published

2024-01-12

Updated

2026-08-04

Proof-of-concept exploits (11)

• http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-…
• Chocapikk/CVE-2024-2188758★ · 2026-01-08
• Chocapikk/CVE-2024-21893-to-CVE-2024-2188727★ · 2025-04-06
• duy-31/CVE-2023-46805_CVE-2024-2188723★ · 2024-01-17
• oways/ivanti-CVE-2024-218877★ · 2024-01-14
• raminkarimkhani1996/CVE-2023-46805_CVE-2024-218875★ · 2024-03-23
• rxwx/pulse-meter1★ · 2025-02-13
• stephen-murcott/Ivanti-ICT-Snapshot-decryption1★ · 2024-02-08
• pwniel/ivanti_shell
• webdev11-code/shell-injection
• xingchennb/POC-

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21887.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure…

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-21887.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-21716
• CVE-2023-35636
• CVE-2023-46805
• CVE-2023-51764
• CVE-2023-7028
• CVE-2024-21413