CVE-2024-21887 is a command injection vulnerability in Ivanti Connect Secure and Ivanti Policy Secure that, on its own, requires administrator authentication to execute arbitrary commands on the appliance — but attackers chained it with the separate unauthenticated CVE-2023-46805 auth-bypass flaw to run commands without any credentials, and both were exploited in the wild as zero-days before patches were available.
Vulnerability summary
CVSS base score
9.1
Critical severity
EPSS score (FIRST)
100.0%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2024-21887 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Ivanti Connect Secure | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | 9.0 through 9.1R18; 22.1R1 through 22.6R2 |
| Ivanti Policy Secure | cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:* | 9.0 through 9.1R18; 22.1R1 through 22.6R1 |
What does this mean for affected devices?
CVE-2024-21887 is a command injection flaw (CWE-77) in web components of Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure (versions 9.x and 22.x). As scored, it requires an authenticated administrator to send a specially crafted request to execute arbitrary commands on the appliance (NVD).
NVD's own analysis and the submitting CNA (HackerOne, on Ivanti's behalf) agree: CVSS v3.1 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, but privileges required, with a scope change and high impact to confidentiality, integrity and availability (NVD).
The privilege requirement is why this CVE is rarely discussed alone: CISA's alert on the same release describes active exploitation of CVE-2024-21887 together with the separate authentication-bypass vulnerability CVE-2023-46805, stating "Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887" and that a threat actor could exploit these vulnerabilities to take control of an affected system; it directed users to immediately apply Ivanti's workaround (CISA Alert: Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways).
CISA added CVE-2024-21887 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-10, with a required-action due date of 2024-01-22, and the catalog records known use in ransomware campaigns (CISA KEV).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.99999 (100th percentile) — effectively certain exploitation activity continues to be observed (FIRST EPSS).
Because this flaw is most dangerous when chained with CVE-2023-46805, any Connect Secure or Policy Secure appliance on an affected build should be upgraded per Ivanti's guidance and investigated for signs of prior compromise, rather than treated as low risk solely on the basis of its "privileges required" rating.
Evidence
- Command injection in web components of Ivanti Connect Secure/Policy Secure (9.x, 22.x) lets an authenticated administrator execute arbitrary commands via crafted requests. — NVD
- CVSS v3.1 base score is 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, agreed by both NVD and the submitting CNA. — NVD
- Ivanti reported active exploitation of both CVE-2023-46805 and CVE-2024-21887, used together to take control of affected systems; CISA directed immediate application of Ivanti's workaround. — CISA Alert
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-01-10, due date 2024-01-22, with known ransomware campaign use. — CISA KEV
- EPSS score is 0.99999 (100th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Does CVE-2024-21887 require authentication to exploit on its own?
Yes, in isolation — NVD's CVSS v3.1 vector for CVE-2024-21887 includes PR:H (privileges required: high), meaning the scored exploitation path needs an authenticated administrator; it only becomes an unauthenticated risk when chained with the separate CVE-2023-46805 auth-bypass flaw, per NVD.
What does the 'scope changed' element of CVE-2024-21887's CVSS vector mean in practice?
A scope change (S:C) in the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicates the vulnerable component's impact extends beyond its own security scope — consistent with command injection in a web component letting an attacker affect the underlying appliance OS, not just the web application itself, per NVD.
What did CISA's alert say about the relationship between CVE-2024-21887 and CVE-2023-46805?
CISA's alert states "Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887" together, and that a threat actor could exploit these vulnerabilities in combination to take control of an affected system — language CISA used to justify directing users to apply Ivanti's workaround immediately, per CISA Alert.
Why is CVE-2024-21887's EPSS score essentially the maximum possible?
As of 2026-10-20, FIRST scores CVE-2024-21887 at 0.99999 — the 100th percentile — reflecting that exploitation activity for this flaw, chained with CVE-2023-46805, has been observed essentially continuously since its disclosure as part of a zero-day attack chain, per FIRST EPSS.
Questions about this page?