---
id: "CVE-2024-21893"
kind: "vulnerability"
aliases: ["CVE-2024-21893"]
title: "A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti\u2026"
severity: "high"
cvss: 8.2
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Ivanti Connect Secure, Policy Secure, and Neurons", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 9.1", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 21.9", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 21.12", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 22.1", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 22.2", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 22.3", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 22.4", "ecosystem": "vendor"}, {"name": "ivanti connect secure", "fixed": [], "affected": "= 22.6", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 9.1", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.1", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.2", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.3", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.4", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.5", "ecosystem": "vendor"}, {"name": "ivanti policy secure", "fixed": [], "affected": "= 22.6", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "= 22.2", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "= 22.3", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "= 22.4", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "= 22.5", "ecosystem": "vendor"}, {"name": "ivanti neurons for zero-trust access", "fixed": [], "affected": "= 22.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ivanti-connect-secure", "ivanti-neurons", "ivanti-policy-secure", "ransomware", "self-hosted", "vendor", "vpn"]
not_affected_if: ["unknown"]
published_at: "2024-01-31T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21893", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti…

Ivanti Connect Secure, Policy Secure, and Neurons have a server-side request forgery flaw in the SAML component that lets an unauthenticated attacker reach restricted internal resources. CISA lists it as known exploited in the wild and tagged with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ivanti Connect Secure, Policy Secure, and Neurons affected ? fixed ?
- vendor:ivanti connect secure affected = 9.0 fixed ?
- vendor:ivanti connect secure affected = 9.1 fixed ?
- vendor:ivanti connect secure affected = 21.9 fixed ?
- vendor:ivanti connect secure affected = 21.12 fixed ?
- vendor:ivanti connect secure affected = 22.1 fixed ?
- vendor:ivanti connect secure affected = 22.2 fixed ?
- vendor:ivanti connect secure affected = 22.3 fixed ?
- vendor:ivanti connect secure affected = 22.4 fixed ?
- vendor:ivanti connect secure affected = 22.6 fixed ?
- vendor:ivanti policy secure affected = 9.0 fixed ?
- vendor:ivanti policy secure affected = 9.1 fixed ?
- vendor:ivanti policy secure affected = 22.1 fixed ?
- vendor:ivanti policy secure affected = 22.2 fixed ?
- vendor:ivanti policy secure affected = 22.3 fixed ?
- vendor:ivanti policy secure affected = 22.4 fixed ?
- vendor:ivanti policy secure affected = 22.5 fixed ?
- vendor:ivanti policy secure affected = 22.6 fixed ?
- vendor:ivanti neurons for zero-trust access affected ? fixed ?
- vendor:ivanti neurons for zero-trust access affected = 22.2 fixed ?
- vendor:ivanti neurons for zero-trust access affected = 22.3 fixed ?
- vendor:ivanti neurons for zero-trust access affected = 22.4 fixed ?
- vendor:ivanti neurons for zero-trust access affected = 22.5 fixed ?
- vendor:ivanti neurons for zero-trust access affected = 22.6 fixed ?

## Fix

Apply the mitigations per Ivanti's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21893
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-21893

## Documents

- [discussion] @wdormann.bsky.social: Ivanti Connect Secure is vulnerable to xmltooling CVE-2023-36661.
How was this h https://bsky.app/profile/wdormann.bsky.social/post/3kkjnns2n2426

## From the sources

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_