Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Ivanti Connect Secure and Policy Secure: Remote Code Execution via Administrator Privileges

CVE-2024-38656 · published 1 year ago
Summary

Some Ivanti Connect Secure and Policy Secure users with administrator access can allow an attacker to take control of the system. This is a serious risk, as it could lead to sensitive data being stolen or altered. If you use these versions, update to the latest version to prevent this risk.

What to do
  • Update ivanti connect_secure to version 22.7 or later.
  • Update ivanti policy_secure to version 22.7 or later.
Affected software
VendorProductAffected versions
ivanti connect_secure < 22.7
22.7
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
ivanti policy_secure < 22.7
22.7
cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*
Original advisory text
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to ach...
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published13 Nov 2024
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-38656 · NVD
Track software like this
Free during beta