An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…
Ivanti · ICS
An XML external entity (XXE) vulnerability exists in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. An unauthenticated attacker over the network, requiring no user interaction, can access certain restricted resources through the flaw.
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 7 days before it was disclosed. Public exploit code (PoC-in-GitHub) was available 4 days before disclosure.
- First seen exploitedVulnCheck KEV evidence7 days before
- Public exploit codePoC-in-GitHub4 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 9 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Comprehensive Threat Intelligence Report: Charming Kitten.16 Oct 2025
- Malicious Domains10 May 2024
- New Campaigns from Scattered Spider10 May 2024
- Zero-day vulnerability in Ivanti software26 Mar 2024
- Zero-day vulnerability in Ivanti software20 Mar 2024
- Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways1 Mar 2024
- 3 more on OTX