CVE-2024-21893 is a server-side request forgery (SSRF) in the SAML component of Ivanti Connect Secure, Policy Secure and Neurons for ZTA that lets an attacker reach certain restricted resources without authentication, and was used by threat actors chained with other Ivanti flaws for widespread pre-authentication remote code execution, including in ransomware campaigns.
Vulnerability summary
CVSS base score
8.2
High severity
EPSS score (FIRST)
100.0%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2024-21893 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Ivanti Connect Secure | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | 9.0 through 22.6-R2.1 (enumerated vulnerable builds per NVD's CPE applicability statement) |
| Ivanti Policy Secure | cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:* | 9.0 through 22.6-R1 (enumerated vulnerable builds per NVD's CPE applicability statement) |
| Ivanti Neurons for Zero Trust Access (ZTA) gateways | cpe:2.3:a:ivanti:neurons_for_zta:*:*:*:*:*:*:*:* | 22.2-R1 through 22.6-R1.2 (enumerated vulnerable builds per NVD's CPE applicability statement) |
What does this mean for affected devices?
CVE-2024-21893 is a server-side request forgery vulnerability (CWE-918) in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for Zero Trust Access (ZTA) gateways. It lets an attacker access certain restricted resources without providing any credentials (NVD).
NVD's primary analysis gives CVSS v3.1 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction required. A CNA-reported CVSS v3.0 score of 8.2 using the same vector was separately submitted via Ivanti's bug-bounty intake (HackerOne) and matches NVD's figure (NVD).
This SSRF flaw was disclosed alongside — and is routinely chained with — CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) in the same Ivanti product line, letting an unauthenticated attacker escalate an SSRF request into full remote code execution on the gateway.
CISA added CVE-2024-21893 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-31, with a required action to "apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable" and a due date of 2024-02-02 — a two-day window reflecting active, widespread exploitation at the time of listing. The KEV catalog records known use of this CVE in ransomware campaigns (CISA KEV).
Ivanti's own vendor advisory page is access-restricted (HTTP 403); affected-version detail here is sourced to NVD's CPE applicability statement instead: Ivanti Connect Secure and Policy Secure builds from 9.0 through 22.6-R2.1/22.6-R1, and Ivanti Neurons for ZTA builds 22.2-R1 through 22.6-R1.2, are listed as vulnerable (NVD).
The joint CISA advisory AA24-060B, "Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways", describes these vulnerabilities as usable "in a chain of exploits to enable malicious cyber threat actors to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges", documents web shells (GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE, CHAINLINE) deployed via this chain, and notes threat actors were able to deceive Ivanti's Integrity Checker Tool to evade detection. Recommended mitigations include limiting outbound internet connections from SSL-VPN appliances and limiting SSL-VPN logons to unprivileged accounts (CISA Advisory AA24-060B).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.99999 (99.999th percentile) — effectively the maximum EPSS score — consistent with a vulnerability that remains almost universally scanned and exploited years after disclosure (FIRST EPSS).
Any Ivanti Connect Secure, Policy Secure or Neurons for ZTA deployment on an affected build should be patched to the vendor's current release immediately, with CISA's mitigation guidance followed in the meantime and systems checked for prior compromise given the documented ransomware use.
Evidence
- Server-side request forgery (CWE-918) in the SAML component of Ivanti Connect Secure, Policy Secure and Neurons for ZTA lets an attacker access certain restricted resources without authentication. — NVD
- CVSS v3.1 base score is 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, matching the CNA-submitted CVSS v3.0 score of 8.2. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-01-31, due date 2024-02-02, with known ransomware campaign use. — CISA KEV
- Affected builds per NVD's CPE applicability statement: Ivanti Connect Secure and Policy Secure 9.0 through 22.6-R2.1/22.6-R1; Ivanti Neurons for ZTA 22.2-R1 through 22.6-R1.2. — NVD
- Usable in a chain of exploits with CVE-2023-46805 and CVE-2024-21887 to bypass authentication and execute arbitrary commands with elevated privileges; threat actors deployed GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE and CHAINLINE web shells via this chain. — CISA Advisory AA24-060B
- EPSS score is 0.99999 (99.999th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Why was CISA's remediation window for CVE-2024-21893 only two days?
CISA added CVE-2024-21893 to the KEV catalog on 2024-01-31 with a due date of 2024-02-02 — a two-day window, among the shortest on this site — reflecting active, widespread exploitation already underway at the time of listing, per CISA KEV.
Which third Ivanti product line, beyond Connect Secure and Policy Secure, does CVE-2024-21893 affect?
CVE-2024-21893 also affects Ivanti Neurons for Zero Trust Access (ZTA) gateways, on builds 22.2-R1 through 22.6-R1.2 per NVD's CPE applicability statement — a product line not affected by the related CVE-2023-46805 or CVE-2024-21887 advisories on this site, per NVD.
What underlying CWE class does CVE-2024-21893 belong to, and what does that mean for exploitation?
CVE-2024-21893 is classified as CWE-918, server-side request forgery — meaning the vulnerable SAML component can be tricked into making requests to internal resources on the attacker's behalf, which is how it provides access to "certain restricted resources" without credentials, per NVD.
What evasion technique did attackers use after chaining CVE-2024-21893 with other Ivanti flaws?
Per CISA Advisory AA24-060B, threat actors who chained CVE-2024-21893 with CVE-2023-46805 and CVE-2024-21887 were able to deceive Ivanti's own Integrity Checker Tool, the mechanism meant to detect exactly this kind of compromise, allowing the GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE and CHAINLINE web shells to persist undetected, per CISA Advisory AA24-060B.
Questions about this page?