---
id: "CVE-2024-8190"
kind: "vulnerability"
aliases: ["CVE-2024-8190"]
title: "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a\u2026"
severity: "high"
cvss: 7.2
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Ivanti Cloud Services Appliance", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ivanti cloud services appliance", "fixed": [], "affected": "= 4.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloud-services-appliance", "exploited", "infrastructure", "ivanti"]
not_affected_if: ["no-admin-console-exposure", "not-csa-4.6"]
published_at: "2024-09-10T21:15:14+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a…

Ivanti Cloud Services Appliance has an OS command injection flaw in its administrative console. An attacker with application admin credentials can run arbitrary operating system commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ivanti Cloud Services Appliance affected ? fixed ?
- vendor:ivanti cloud services appliance affected = 4.6 fixed ?

## How to check

Identify any Ivanti Cloud Services Appliance (CSA) 4.6.x instances in your environment and confirm the version in the admin console.

## Fix

Remove CSA 4.6.x from service or upgrade to the 5.0.x line, as CISA directs since 4.6.x is end-of-life and will not receive future security updates.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8190
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-8190

## From the sources

Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.

CISA required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_