Virtual Traffic Manager
CVE-2024-7593: Virtual Traffic Manager Authentication Bypass
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Published
ExploitedYes, in CISA KEVAdded 24 Sept 2024
Ransomware useNot reportedPer CISA
SeverityCRITICALCVSS 3.1 9.8
EPSS100%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| vTM 22.2R1, 22.7R2 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Exploitation
CISA lists this CVE as exploited in the wild since 24 Sept 2024.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.