CVE-2024-21887

VendorivantiProductconnect secure, policy secureDiscoveredJan 12, 2024UpdatedAug 4, 2026

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

View graph Watch Export

CVSS v3.1

9.1 CRITICAL

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Connections

7 relationships

CWE-77

source

Timeline

disclosure → media coverage

Jan 12, 2024

Disclosure — published as a CVE record. · last revised by NVD Aug 4, 2026

Oct 5, 2026

thehackernews.com reports: Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Oct 5, 2026

infosecurity-magazine.com reports: ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

Nov 2, 2026

bleepingcomputer.com reports: Ivanti patches two more Connect Secure zero-days chained in attacks

Public PoC (8)

github.com/oways/ivanti-CVE-2024-21887 github.com/duy-31/CVE-2023-46805_CVE-2024-21887 github.com/Chocapikk/CVE-2024-21887 github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887 github.com/seajaysec/Ivanti-Connect-Around-Scan github.com/pwniel/ivanti_shell github.com/rxwx/pulse-meter github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser

Unverified third-party code — review before executing.