CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and...

9.1 CriticalIn KEVPublic exploit

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

100.0%Up 4.3 points since Jan 18, 2024

What each source reports

CVE List Score used 9.1

Record: CVE-2024-21887
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

EUVDEUVD-2024-19498 9.1

Record: EUVD-2024-19498
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-87qj-c5f7-6c8q 9.1

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and...

Record: GHSA-87qj-c5f7-6c8q
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

CISA KEV No score

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

Record: CVE-2024-21887
Weakness: CWE-77
Updated: 2026-11-02

NVD 9.1

Record: CVE-2024-21887
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Ivanti Connect Secure Unauthenticated Remote Code Execution	2024-01-10
PoC in GitHub	oways/ivanti-CVE-2024-21887	2024-01-14
PoC in GitHub	Chocapikk/CVE-2024-21887	2024-01-16
PoC in GitHub	duy-31/CVE-2023-46805_CVE-2024-21887	2024-01-16
PoC in GitHub	raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887	2024-01-18
PoC in GitHub	seajaysec/Ivanti-Connect-Around-Scan	2024-01-19
Metasploit	Ivanti Connect Secure Unauthenticated Remote Code Execution	2024-01-31
PoC in GitHub	pwniel/ivanti_shell	2024-02-24
PoC in GitHub	rxwx/pulse-meter	2025-01-14
PoC in GitHub	Hexastrike/Ivanti-Connect-Secure-Logs-Parser	2025-01-19
Nuclei	Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21887 is a critical vulnerability (CVSS 9.1) in Ivanti Connect Secure, published January 12, 2024. CISA lists it as known to be exploited, since January 10, 2024. EUVD reports exploitation since January 10, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 100th percentile. No source names a fixed version.