{"id":"CVE-2024-7593","kind":"vulnerability","aliases":["CVE-2024-7593"],"related":[],"title":"ivanti virtual traffic manager: Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a…","description":"Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Ivanti Virtual Traffic Manager has an authentication bypass that lets a remote, unauthenticated attacker create an administrator account of their choosing. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-09-24T00:00:00+00:00","products":[{"name":"Ivanti Virtual Traffic Manager","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti virtual traffic manager","fixed":[],"affected":"= 22.2","ecosystem":"vendor"},{"name":"ivanti virtual traffic manager","fixed":[],"affected":"= 22.3","ecosystem":"vendor"},{"name":"ivanti virtual traffic manager","fixed":[],"affected":"= 22.5","ecosystem":"vendor"},{"name":"ivanti virtual traffic manager","fixed":[],"affected":"= 22.6","ecosystem":"vendor"},{"name":"ivanti virtual traffic manager","fixed":[],"affected":"= 22.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ivanti","load-balancer","self-hosted","vtm"],"not_affected_if":["no-vtm-deployed"],"how_to_check":"Identify Ivanti Virtual Traffic Manager (vTM) instances in your estate and check their installed version against the vendor advisory.","fix":"Apply the vendor mitigations or upgrade to a fixed version per Ivanti's advisory; if no mitigation is available, discontinue use of the product as CISA requires.","status":"open","published_at":"2024-08-13T19:15:16+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:34+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or upgrade to a fixed version per Ivanti's advisory; if no mitigation is available, discontinue use of the product as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"Ivanti Virtual Traffic Manager has an authentication bypass that lets a remote, unauthenticated attacker create an administrator account of their choosing. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["ivanti","vtm","load-balancer","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker creates an admin account and takes full control of the appliance","analyst_note":"Sources do not list affected or fixed versions or the vendor advisory URL; find Ivanti's advisory for CVE-2024-7593 and record the affected and fixed versions and the mitigation steps.","how_to_check":"Identify Ivanti Virtual Traffic Manager (vTM) instances in your estate and check their installed version against the vendor advisory.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-vtm-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000509,"input_tokens":2840,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':24A,27A '-7593':25A,28A '22.2':17A '22.7':20A 'account':80B,113C 'action':116C 'activ':88B 'administr':79B,112C 'algorithm':10A 'allow':22A,103C 'appli':117C 'attack':76B,107C 'authent':9A,69B,99C 'balanc':58B 'bypass':70B,100C 'choos':83B 'chosen':111C 'cisa':84B,114C 'contain':97C 'creat':77B,109C 'cve':23A,26A 'discontinu':123C 'exploit':53B,89B 'host':61B 'implement':6A 'incorrect':5A 'infrastructur':54B 'instruct':121C 'ivanti':1A,12A,29A,33A,37A,41A,45A,49A,55B,63B,93C 'let':72B 'list':85B 'load':57B 'load-balanc':56B 'manag':4A,66B,96C 'manager':32A,36A,40A,44A,48A,52A 'mitig':118C,129C 'per':119C 'product':127C 'r1':18A 'r2':21A 'remot':74B,105C 'requir':115C 'self':60B 'self-host':59B 'traffic':3A,31A,35A,39A,43A,47A,51A,65B,95C 'unauthent':75B,106C 'unavail':131C 'use':124C 'vendor':120C 'version':16A 'virtual':2A,30A,34A,38A,42A,46A,50A,64B,94C 'vtm':13A,62B 'vulner':101C 'wild':92B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-13T19:15:16+00:00","kev":{"dateAdded":"2024-09-24","dueDate":"2024-10-15","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-7593","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7593","severity":null,"published_at":"2024-09-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:33+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-7593","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7593","severity":null,"published_at":"2024-08-13T19:15:16+00:00","modified_at":"2026-06-17T08:20:30+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}