Unrated severityCISA KEVNVD Advisory· Published Jan 31, 2024· Updated Oct 21, 2025

CVE-2024-21893

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Affected products

Ivanti/Connect Securellm-fuzzy
Range: 9.x, 22.x
Ivanti/Policy Securellm-fuzzy
Range: 9.x, 22.x
Ivanti/Neurons for ZTA gatewaysllm-fuzzy
Ivanti/ICSv5
Range: 9.1R18
Ivanti/IPSv5
Range: 9.1R18

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Securemitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.080
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.060