{"id":"CVE-2021-44529","published":"2021-12-08T22:15:10Z","modified":"2026-08-04T05:16:27Z","title":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","vendor":"Ivanti","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","tier":"core","eol":null,"description":{"text":"A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","provenance":"source","from":"NVD"},"summary":{"text":"A code injection flaw in Ivanti's Endpoint Manager Cloud Service Appliance (EPM CSA) lets an attacker run arbitrary code on the appliance with limited \"nobody\" permissions. No authentication or user interaction is required, and the attack can be launched over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99105,"percentile":0.99933,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-03-25","dueDate":"2024-04-15","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2021-44529","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-29","exploitedFirstSeen":"2024-02-29","ransomware":true,"evidence":[{"url":"https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/","date":"2024-02-29"},{"url":"https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/","date":"2024-02-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-03-25"},{"url":"https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/","date":"2024-04-15"},{"url":"https://harfanglab.io/insidethelab/insights-ivanti-csa-exploitation/","date":"2024-12-12"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://blog.talosintelligence.com/content/files/2025/03/2024YiR-report.pdf","date":"2025-03-31"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2021-44529","date":"2025-06-07"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-Early-Warning-Signals-Attacker-Behavior-Precedes-New-Vulnerabilities-Report.pdf","date":"2025-07-31"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/SA-2021-12-02","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/SA-2021-12-02","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the \"csrf-magic\", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's \"nobody\" user account. ","confidence":"high"},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the \"csrf-magic\", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's \"nobody\" user account. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-31360","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31360","exploited":true,"exploitedSince":"2024-03-25","provenance":"source"},"exploits":[{"id":50833,"url":"https://www.exploit-db.com/exploits/50833","title":"Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2022-03-22","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-03-22"},"pocGithub":{"count":2,"skipped":0,"earliest":"2022-03-24","earliestUrl":"https://github.com/jkana/CVE-2021-44529","repos":[{"name":"jkana/CVE-2021-44529","url":"https://github.com/jkana/CVE-2021-44529","stars":5,"created":"2022-03-24"},{"name":"jax7sec/CVE-2021-44529","url":"https://github.com/jax7sec/CVE-2021-44529","stars":2,"created":"2022-04-16"}]},"metasploit":[{"name":"Ivanti Cloud Services Appliance (CSA) Command Injection","module":"exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529","type":"exploit","disclosureDate":"2021-12-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_csa_unauth_rce_cve_2021_44529.rb"}],"nuclei":[{"id":"CVE-2021-44529","name":"Ivanti EPM Cloud Services Appliance Code Injection","severity":"critical","path":"http/cves/2021/CVE-2021-44529.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44529.yaml"}],"first":{"date":"2021-12-02","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_csa_unauth_rce_cve_2021_44529.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html","http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1195.002"],"provenance":"source"}],"timeline":[{"date":"2021-12-02","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2022-03-22, PoC-in-GitHub 2022-03-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_csa_unauth_rce_cve_2021_44529.rb","provenance":"source"},{"date":"2021-12-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44529","provenance":"source"},{"date":"2024-02-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/","provenance":"source"},{"date":"2024-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31360","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":838},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 973 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}