{"id":"CVE-2021-44529","aliases":["EUVD-2021-31360","GHSA-wg22-f643-fv8w"],"status":"published","title":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an...","description":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99105,"percentile":0.99933,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2021-12-08T00:00:00Z","modified":"2026-08-04T05:16:27Z","kev":{"date_added":"2024-03-25","due_date":"2024-04-15","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-03-25"},{"source":"kev","since":"2024-03-25"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529","title":"Ivanti Cloud Services Appliance (CSA) Command Injection","type":"exploit","platform":"Linux,PHP,Unix","date":"2021-12-02","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529"},{"source":"exploitdb","id":"EDB-50833","title":"Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2022-03-22","url":"https://www.exploit-db.com/exploits/50833"},{"source":"pocgithub","id":"jkana/CVE-2021-44529","title":"jkana/CVE-2021-44529","date":"2022-03-24","url":"https://github.com/jkana/CVE-2021-44529"},{"source":"pocgithub","id":"jax7sec/CVE-2021-44529","title":"jax7sec/CVE-2021-44529","date":"2022-04-16","url":"https://github.com/jax7sec/CVE-2021-44529"},{"source":"nuclei","id":"CVE-2021-44529","title":"Ivanti EPM Cloud Services Appliance Code Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44529.yaml"}],"products":[{"vendor":"ivanti","product":"endpoint manager cloud service appliance (epm csa)"},{"vendor":"ivanti","product":"endpoint_manager_cloud_services_appliance"}],"references":[{"url":"https://forums.ivanti.com/s/article/SA-2021-12-02","tags":["x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44529"},{"url":"https://github.com/advisories/GHSA-wg22-f643-fv8w"}],"sources":{"cve":[{"id":"CVE-2021-44529","description":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","status":"published","published":"2021-12-08T00:00:00Z","modified":"2026-08-04T03:55:34.087Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-31360","description":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","status":"published","published":"2021-12-08T00:00:00Z","modified":"2026-08-04T03:55:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-03-25","updated_at":"2026-11-02T18:02:23.68186Z"}],"ghsa":[{"id":"GHSA-wg22-f643-fv8w","title":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an...","description":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","status":"published","published":"2021-12-09T00:00:14Z","modified":"2025-10-22T00:33:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2021-44529","title":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability ","description":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).","cwes":["CWE-94"],"kev":{"date_added":"2024-03-25","due_date":"2024-04-15","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-44529","description":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","status":"published","published":"2021-12-08T22:15:10.163Z","modified":"2026-08-04T05:16:27.567Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:02.189991Z"}]}}