CVE-2024-21893: Ivanti Connect Secure SSRF

CVE-2024-21893 is a server-side request forgery (SSRF) in the SAML component of Ivanti Connect Secure, Policy Secure and Neurons for ZTA that lets an attacker reach certain restricted resources without authentication, and was used by threat actors chained with other Ivanti flaws for widespread pre-authentication remote code execution, including in ransomware campaigns.

CVE-2024-21893 is a server-side request forgery vulnerability (CWE-918) in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for Zero Trust Access (ZTA) gateways. It lets an attacker access certain restricted resources without providing any credentials (NVD).

NVD's primary analysis gives CVSS v3.1 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction required. A CNA-reported CVSS v3.0 score of 8.2 using the same vector was separately submitted via Ivanti's bug-bounty intake (HackerOne) and matches NVD's figure (NVD).

This SSRF flaw was disclosed alongside — and is routinely chained with — CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) in the same Ivanti product line, letting an unauthenticated attacker escalate an SSRF request into full remote code execution on the gateway.

CISA added CVE-2024-21893 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-31, with a required action to "apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable" and a due date of 2024-02-02 — a two-day window reflecting active, widespread exploitation at the time of listing. The KEV catalog records known use of this CVE in ransomware campaigns (CISA KEV).

Ivanti's own vendor advisory page returned an HTTP 403 when fetched directly for this report, so affected-version detail here is sourced to NVD's CPE applicability statement instead: Ivanti Connect Secure and Policy Secure builds from 9.0 through 22.6-R2.1/22.6-R1, and Ivanti Neurons for ZTA builds 22.2-R1 through 22.6-R1.2, are listed as vulnerable (NVD).

The joint CISA advisory AA24-060B, "Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways", describes these vulnerabilities as usable "in a chain of exploits to enable malicious cyber threat actors to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges", documents web shells (GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE, CHAINLINE) deployed via this chain, and notes threat actors were able to deceive Ivanti's Integrity Checker Tool to evade detection. Recommended mitigations include limiting outbound internet connections from SSL-VPN appliances and limiting SSL-VPN logons to unprivileged accounts (CISA Advisory AA24-060B).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.99999 (99.999th percentile) — effectively the maximum EPSS score — consistent with a vulnerability that remains almost universally scanned and exploited years after disclosure (FIRST EPSS).

Any Ivanti Connect Secure, Policy Secure or Neurons for ZTA deployment on an affected build should be patched to the vendor's current release immediately, with CISA's mitigation guidance followed in the meantime and systems checked for prior compromise given the documented ransomware use.

• Server-side request forgery (CWE-918) in the SAML component of Ivanti Connect Secure, Policy Secure and Neurons for ZTA lets an attacker access certain restricted resources without authentication. — NVD
• CVSS v3.1 base score is 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, matching the CNA-submitted CVSS v3.0 score of 8.2. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-01-31, due date 2024-02-02, with known ransomware campaign use. — CISA KEV
• Affected builds per NVD's CPE applicability statement: Ivanti Connect Secure and Policy Secure 9.0 through 22.6-R2.1/22.6-R1; Ivanti Neurons for ZTA 22.2-R1 through 22.6-R1.2. — NVD
• Usable in a chain of exploits with CVE-2023-46805 and CVE-2024-21887 to bypass authentication and execute arbitrary commands with elevated privileges; threat actors deployed GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE and CHAINLINE web shells via this chain. — CISA Advisory AA24-060B
• EPSS score is 0.99999 (99.999th percentile) as of 2026-10-20. — FIRST EPSS