CVE-2024-21887: Ivanti Connect Secure command injection

CVE-2024-21887 is a command injection vulnerability in Ivanti Connect Secure and Ivanti Policy Secure that, on its own, requires administrator authentication to execute arbitrary commands on the appliance — but attackers chained it with the separate unauthenticated CVE-2023-46805 auth-bypass flaw to run commands without any credentials, and both were exploited in the wild as zero-days before patches were available.

CVE-2024-21887 is a command injection flaw (CWE-77) in web components of Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure (versions 9.x and 22.x). As scored, it requires an authenticated administrator to send a specially crafted request to execute arbitrary commands on the appliance (NVD).

NVD's own analysis and the submitting CNA (HackerOne, on Ivanti's behalf) agree: CVSS v3.1 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, but privileges required, with a scope change and high impact to confidentiality, integrity and availability (NVD).

The privilege requirement is why this CVE is rarely discussed alone: CISA's alert on the same release describes active exploitation of CVE-2024-21887 together with the separate authentication-bypass vulnerability CVE-2023-46805, stating "Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887" and that a threat actor could exploit these vulnerabilities to take control of an affected system; it directed users to immediately apply Ivanti's workaround (CISA Alert: Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways).

CISA added CVE-2024-21887 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-10, with a required-action due date of 2024-01-22, and the catalog records known use in ransomware campaigns (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.99999 (100th percentile) — effectively certain exploitation activity continues to be observed (FIRST EPSS).

Because this flaw is most dangerous when chained with CVE-2023-46805, any Connect Secure or Policy Secure appliance on an affected build should be upgraded per Ivanti's guidance and investigated for signs of prior compromise, rather than treated as low risk solely on the basis of its "privileges required" rating.

• Command injection in web components of Ivanti Connect Secure/Policy Secure (9.x, 22.x) lets an authenticated administrator execute arbitrary commands via crafted requests. — NVD
• CVSS v3.1 base score is 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, agreed by both NVD and the submitting CNA. — NVD
• Ivanti reported active exploitation of both CVE-2023-46805 and CVE-2024-21887, used together to take control of affected systems; CISA directed immediate application of Ivanti's workaround. — CISA Alert
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-01-10, due date 2024-01-22, with known ransomware campaign use. — CISA KEV
• EPSS score is 0.99999 (100th percentile) as of 2026-10-20. — FIRST EPSS