{"id":"CVE-2024-21893","kind":"vulnerability","aliases":["CVE-2024-21893"],"related":[],"title":"A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti…","description":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Ivanti Connect Secure, Policy Secure, and Neurons have a server-side request forgery flaw in the SAML component that lets an unauthenticated attacker reach restricted internal resources. CISA lists it as known exploited in the wild and tagged with ransomware use.","severity":"high","cvss":8.2,"epss":null,"exploited":true,"exploited_at":"2024-01-31T00:00:00+00:00","products":[{"name":"Ivanti Connect Secure, Policy Secure, and Neurons","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 9.1","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 21.9","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 21.12","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.1","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.2","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.3","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.4","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.6","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 9.1","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.1","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.2","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.3","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.4","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.5","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.6","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.2","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.3","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.4","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.5","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ivanti-connect-secure","ivanti-neurons","ivanti-policy-secure","ransomware","self-hosted","vendor","vpn"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations per Ivanti's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2024-01-31T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:24+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:02:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per Ivanti's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).","reach":"internet","impact":"medium","summary":"Ivanti Connect Secure, Policy Secure, and Neurons have a server-side request forgery flaw in the SAML component that lets an unauthenticated attacker reach restricted internal resources. CISA lists it as known exploited in the wild and tagged with ransomware use.","category":"vendor","who_cares":["ivanti-connect-secure","ivanti-policy-secure","ivanti-neurons","self-hosted","vpn"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reaches restricted internal resources through the appliance","analyst_note":"Find Ivanti's advisory and the affected/fixed version ranges and mitigation steps; the KEV entry does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000488,"input_tokens":2923,"output_tokens":392,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':23A,26A '-21893':24A,27A '22':18A '9':16A 'access':92A,99A,106A,113A,120A,127A,222C 'action':230C 'allow':218C 'and':33A 'appli':231C 'attack':169B,220C 'authent':227C 'certain':223C 'cisa':174B,228C 'compon':11A,164B,216C 'connect':14A,29A,36A,39A,42A,45A,48A,51A,54A,57A,60A,131B,147B,189C,196C 'contain':204C 'cve':22A,25A 'discontinu':237C 'exploit':128B,179B 'flaw':160B 'for':88A,95A,102A,109A,116A,123A 'forgeri':6A,159B,210C 'former':192C 'host':143B 'ic':191C 'instruct':235C 'intern':172B 'ivanti':13A,21A,28A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,93A,100A,107A,114A,121A,130B,134B,137B,146B,188C,198C,202C 'ivanti-connect-secur':129B 'ivanti-neuron':133B 'ivanti-policy-secur':136B 'known':178B,193C 'let':166B 'list':175B 'mitig':232C,243C 'neuron':135B,152B,203C 'neurons':34A,87A,94A,101A,108A,115A,122A 'per':233C 'polici':138B,149B,199C 'policy':31A,63A,66A,69A,72A,75A,78A,81A,84A 'product':241C 'puls':195C 'ransomwar':140B,186B 'reach':170B 'request':5A,158B,209C 'requir':229C 'resourc':173B,225C 'restrict':171B,224C 'saml':10A,163B,215C 'secur':15A,132B,139B,148B,150B,190C,197C,200C 'secure':30A,32A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A 'self':142B 'self-host':141B 'server':3A,156B,207C 'server-sid':2A,155B,206C 'side':4A,157B,208C 'ssrf':211C 'tag':184B 'trust':91A,98A,105A,112A,119A,126A 'unauthent':168B 'unavail':245C 'use':187B,238C 'vendor':144B,234C 'vpn':145B 'vulner':7A,212C 'wild':182B 'without':226C 'x':17A,19A 'zero':90A,97A,104A,111A,118A,125A 'zero-trust':89A,96A,103A,110A,117A,124A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-01-31T00:00:00+00:00","kev":{"dateAdded":"2024-01-31","dueDate":"2024-02-02","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-21893","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21893","severity":null,"published_at":"2024-01-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-21893","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21893","severity":null,"published_at":"2024-01-31T18:15:47+00:00","modified_at":"2026-08-04T05:16:30+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[{"id":753,"url":"https://bsky.app/profile/wdormann.bsky.social/post/3kkjnns2n2426","title":"@wdormann.bsky.social: Ivanti Connect Secure is vulnerable to xmltooling CVE-2023-36661.\nHow was this h","kind":"post","source":"bluesky","text":"Ivanti Connect Secure is vulnerable to xmltooling CVE-2023-36661.\nHow was this handled?\nHackerOne assigned CVE-2024-21893 to capture this.\nNobody knows how CVE works, and nobody enforces any rules.  🤦‍♂️\ntwitter.com/stephenfewer...\nhttps://twitter.com/stephenfewer/status/1753507673742405636\n\nlikes 4 reposts 1","published_at":"2024-02-03T16:41:46+00:00","relation":"discussion","confidence":null,"note":"@wdormann.bsky.social"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}