{"id":"CVE-2024-21887","published":"2024-01-12T17:15:10Z","modified":"2026-08-04T05:16:30Z","title":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","vendor":"Ivanti","product":"Connect Secure and Policy Secure","tier":"core","eol":null,"description":{"text":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in the web components of Ivanti Connect Secure and Ivanti Policy Secure lets an attacker execute arbitrary commands on the appliance. Exploitation requires that the attacker already holds administrator credentials on the affected device, which they can then use to send specially crafted requests over the network without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:10Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-01-10","dueDate":"2024-01-22","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-10","exploitedFirstSeen":"2024-01-10","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-10"},{"url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","date":"2024-01-10"},{"url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day","date":"2024-01-12"},{"url":"https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global","date":"2024-01-15"},{"url":"https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/","date":"2024-01-15"},{"url":"https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2023-46805-cve-2024-21887/","date":"2024-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-18&host_type=src&vulnerability=cve-2024-21887","date":"2024-01-18"},{"url":"https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/","date":"2024-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-19&host_type=src&vulnerability=cve-2024-21887","date":"2024-01-19"},{"url":"https://northwave-cybersecurity.com/whitepapers-articles/investigating-a-possible-ivanti-compromise","date":"2024-01-19"}],"evidenceTotal":980,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"ARMORY CASTLE Exploits BeyondTrust","url":"https://otx.alienvault.com/pulse/6ad9e67ca1c7d1ceba4d86e7","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise. Threat actors have been reported as likely targeting credentials and the deployment of web shells to provide future access.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise. Threat actors have been reported as likely targeting credentials and the deployment of web shells to provide future access.","confidence":"high"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-passage"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection; keyword query KW:T1505.003:1","mappingType":"secondary_impact","evidence":[{"reportId":"SRC-69c48a8dfa48e4fbb916","quote":"Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.","start":1830,"end":2115}],"comment":"This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise. Threat actors have been reported as likely targeting credentials and the deployment of web shells to provide future access.","confidence":"high"},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise. Threat actors have been reported as likely targeting credentials and the deployment of web shells to provide future access.","confidence":"high"}],"reports":[{"id":"SRC-69ce9610bb628b0a6cad","title":"Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion","publisher":"ctid.mitre.org","url":"https://ctid.mitre.org/blog/2024/05/22/infiltrating-defenses-abusing-vmware-in-mitres-cyber-intrusion/","date":"2024-05-22","mentions":[{"quote":"Adversary compromised MITRE’s prototypingnetwork through a pair of zero-day vulnerabilities in Ivanti Connect Secure (CVE-2023–46805 & CVE-2024–21887)","start":2881,"end":3031}]},{"id":"SRC-b29db5c20a3fa9923618","title":"Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN","publisher":"volexity.com","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","date":"2024-01-10","mentions":[{"quote":"CVE-2024-21887 – a command-injection vulnerability found into multiple web components with a CVSS score of 9.1","start":2666,"end":2776}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2024-21887 - Ivanti Connect Secure and Ivanti Policy Secure web-component command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)","start":8146,"end":8318},{"quote":"CVE-2024-21887","start":84241,"end":84255}]},{"id":"SRC-69c48a8dfa48e4fbb916","title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":null,"mentions":[{"quote":"UNC5221 is a suspected China-nexus espionage actor that previously exploited two vulnerabilities CVE-2023-46805 and CVE-2024-21887 that impacted Ivanti Connect Secure VPN appliances as early as December 2023.","start":1621,"end":1829},{"quote":"Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.","start":1830,"end":2115},{"quote":"Apart from CVE-2023-46805 and CVE-2024-21887, Mandiant has previously observed UNC5221 conducting zero day exploitation of CVE-2023-4966, impacting NetScaler ADC and NetScaler Gateway appliances.","start":25766,"end":25961},{"quote":"10, 2024, disclosure of CVE-2023-46805 and CVE-2024-21887, Mandiant observed widespread exploitation by UNC5221 targeting Ivanti Connect Secure appliances across a wide range of countries and verticals.","start":26358,"end":26560}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19498","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19498","exploited":true,"exploitedSince":"2024-01-10","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":0,"earliest":"2024-01-14","earliestUrl":"https://github.com/oways/ivanti-CVE-2024-21887","repos":[{"name":"Chocapikk/CVE-2024-21887","url":"https://github.com/Chocapikk/CVE-2024-21887","stars":58,"created":"2024-01-16"},{"name":"duy-31/CVE-2023-46805_CVE-2024-21887","url":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887","stars":23,"created":"2024-01-16"},{"name":"seajaysec/Ivanti-Connect-Around-Scan","url":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan","stars":12,"created":"2024-01-19"},{"name":"oways/ivanti-CVE-2024-21887","url":"https://github.com/oways/ivanti-CVE-2024-21887","stars":7,"created":"2024-01-14"},{"name":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","stars":6,"created":"2025-01-19"}]},"metasploit":[{"name":"Ivanti Connect Secure Unauthenticated Remote Code Execution","module":"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805","type":"exploit","disclosureDate":"2024-01-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"},{"name":"Ivanti Connect Secure Unauthenticated Remote Code Execution","module":"exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893","type":"exploit","disclosureDate":"2024-01-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb"}],"nuclei":[{"id":"CVE-2024-21887","name":"Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection","severity":"critical","path":"http/cves/2024/CVE-2024-21887.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21887.yaml"}],"first":{"date":"2024-01-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003","T1552"],"provenance":"source"}],"timeline":[{"date":"2024-01-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-01-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb","provenance":"source"},{"date":"2024-01-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-01-10","kind":"report","label":"Named in volexity.com: Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","provenance":"machine"},{"date":"2024-01-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19498","provenance":"source"},{"date":"2024-01-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21887","provenance":"source"},{"date":"2024-05-22","kind":"report","label":"Named in ctid.mitre.org: Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion","url":"https://ctid.mitre.org/blog/2024/05/22/infiltrating-defenses-abusing-vmware-in-mitres-cyber-intrusion/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":88.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1025 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 8 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-ivanti-connect-secure-cwe-77"}}