{"id":"CVE-2024-8963","published":"2024-09-19T18:15:10Z","modified":"2026-06-17T08:23:38Z","title":"Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability","vendor":"Ivanti","product":"Cloud Services Appliance (CSA)","tier":"core","eol":null,"description":{"text":"Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.","provenance":"source","from":"NVD"},"summary":{"text":"The Ivanti Cloud Services Appliance (CSA) contains a path traversal flaw, a weakness in restricting pathnames to a restricted directory, affecting versions before 4.6 Patch 519. A remote attacker with no authentication, no user interaction and network access to the appliance can exploit it to reach restricted functionality.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:27Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.98607,"percentile":0.99923,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-09-19","dueDate":"2024-10-10","ransomware":false,"requiredAction":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.","notes":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963 ; https://nvd.nist.gov/vuln/detail/CVE-2024-8963","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-09-19","exploitedFirstSeen":"2024-09-19","ransomware":false,"evidence":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963","date":"2024-09-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-09-19"},{"url":"https://www.cybersecurity-help.cz/vdb/SB2024091969","date":"2024-09-19"},{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381?language=en_US","date":"2024-10-08"},{"url":"https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa","date":"2024-10-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-06&host_type=src&vulnerability=cve-2024-8963","date":"2024-11-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-07&host_type=src&vulnerability=cve-2024-8963","date":"2024-11-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-08&host_type=src&vulnerability=cve-2024-8963","date":"2024-11-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-09&host_type=src&vulnerability=cve-2024-8963","date":"2024-11-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-10&host_type=src&vulnerability=cve-2024-8963","date":"2024-11-10"}],"evidenceTotal":619,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote path traversal against public-facing appliance","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker","start":0,"end":94}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Access to restricted functionality implies local data retrieval","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a remote unauthenticated attacker to access restricted functionality","start":54,"end":129}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-49510","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49510","exploited":true,"exploitedSince":"2024-09-19","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-11-13","earliestUrl":"https://github.com/patfire94/CVE-2024-8963","repos":[{"name":"patfire94/CVE-2024-8963","url":"https://github.com/patfire94/CVE-2024-8963","stars":0,"created":"2024-11-13"}]},"nuclei":[{"id":"CVE-2024-8963","name":"Ivanti Cloud Services Appliance - Path Traversal","severity":"critical","path":"http/cves/2024/CVE-2024-8963.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8963.yaml"}],"first":{"date":"2024-11-13","source":"PoC-in-GitHub","url":"https://github.com/patfire94/CVE-2024-8963"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2024-09-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8963","provenance":"source"},{"date":"2024-09-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963","provenance":"source"},{"date":"2024-09-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-09-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49510","provenance":"source"},{"date":"2024-11-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/patfire94/CVE-2024-8963","provenance":"source"}],"speed":{"daysToPublicExploit":55,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":69.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 771 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}