ICS, IPS
CVE-2024-21887: Connect Secure and Policy Secure Command Injection
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| ICS 9.1R18 to 9.1R18 | Upgrade past 9.1R18; see the advisory |
| ICS 22.6R2 to 22.6R2 | Upgrade past 22.6R2; see the advisory |
| IPS 9.1R18 to 9.1R18 | Upgrade past 9.1R18; see the advisory |
| IPS 22.6R1 to 22.6R1 | Upgrade past 22.6R1; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Exploitation
CISA lists this CVE as exploited in the wild since 10 Jan 2024, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.