Endpoint Manager and CSA
CVE-2024-8963: Cloud Services Appliance (CSA) Path Traversal
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Published
ExploitedYes, in CISA KEVAdded 19 Sept 2024
Ransomware useNot reportedPer CISA
SeverityCRITICALCVSS 3.1 9.4
EPSS99%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| CSA (Cloud Services Appliance) 4.6 Patch 519, 5.0 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Exploitation
CISA lists this CVE as exploited in the wild since 19 Sept 2024.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.