ICS, IPS
CVE-2024-21893: Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF)
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| ICS 9.1R18 to 9.1R18 | Upgrade past 9.1R18; see the advisory |
| ICS 22.6R2 to 22.6R2 | Upgrade past 22.6R2; see the advisory |
| IPS 9.1R18 to 9.1R18 | Upgrade past 9.1R18; see the advisory |
| IPS 22.6R1 to 22.6R1 | Upgrade past 22.6R1; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Exploitation
CISA lists this CVE as exploited in the wild since 31 Jan 2024, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.