Security readout for executives and security teams
Plain-English summary
This flaw lets an authenticated administrator send a malicious web request that runs operating-system commands on vulnerable Ivanti gateways. Successful abuse could expose data, alter the appliance, or disrupt service. CISA lists the vulnerability as known exploited, making affected internet-facing gateways an urgent business risk.
Executive priority
Treat this as an immediate priority because gateway compromise can undermine a security boundary and CISA confirms exploitation. Establish ownership, identify exposed appliances, apply vendor guidance, and investigate potentially affected systems. Do not treat patching alone as proof that previously exposed appliances were never compromised.
Technical view
CVE-2024-21887 is a CWE-77 command-injection flaw in web components of Ivanti Connect Secure and Ivanti Policy Secure 9.x and 22.x. It is remotely reachable, requires high privileges, needs no user interaction, and can affect confidentiality, integrity, and availability. The supplied CVSS 3.0 score is 9.1.
Likely exposure
Exposure is most likely where Ivanti Connect Secure or Policy Secure appliances in the identified 9.x or 22.x families remain unremediated, especially when externally accessible. The bundle names ICS 9.1R18 and 22.6R2 and IPS 9.1R18 and 22.6R1, but does not provide complete affected-version boundaries.
Exploitation context
CISA KEV inclusion confirms exploitation in the wild. The vulnerability itself requires authenticated administrator privileges. Ivanti's referenced advisory also addresses CVE-2023-46805 authentication bypass, but the supplied evidence does not establish how every observed attack obtained privileges or which environments were compromised.
Researcher notes
The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. High privileges constrain standalone exploitation, but the referenced Ivanti advisory pairs this issue with an authentication-bypass CVE. Exact affected and fixed build boundaries, indicators, and vendor-prescribed recovery procedures are not included in the bundle and must be confirmed through Ivanti.
Mitigation direction
- Inventory all Ivanti Connect Secure and Policy Secure appliances, including versions and external exposure.
- Follow Ivanti's current advisory to determine applicable remediation; the supplied bundle does not name fixed versions.
- Prioritize externally accessible or high-value gateways for immediate remediation and integrity review.
- Restrict administrative access to trusted management paths while remediation is pending.
- Apply any vendor-recommended mitigations only as documented by Ivanti.
Validation and detection
- Confirm each appliance product, release, build, and remediation state against Ivanti's advisory.
- Verify administrative interfaces are not exposed beyond intended trusted networks.
- Review appliance and centralized logs for anomalous administrative web requests or unexpected command execution.
- Check appliance integrity using vendor-supported methods and investigate unexplained configuration or system changes.
- Reassess exposure after remediation and document any appliance requiring replacement or further investigation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-21887 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36hackeroneVulnerability scoring details
Base CVSS 3.0 score
9.1CriticalVector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-21887 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-01-10T00:00:00.000Z: CVE-2024-21887 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_USCVE reference, hackerone
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.