CVE-2024-21893

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.2EPSS 100%

Published 2024-01-31Updated 2026-05-02

Exploited in the wildMedia 7767PoC

Vulnerability details

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CNAhackerone

EPSS score history

Sources

8 links

PoC links are not available for guest users. Login to view them.

CISA Known Exploited CVEShield Bleeping Computer Bleeping Computer The Hacker News Bleeping Computer Rapid 7 Blogs CVE Organization

Profile

CVSS

8.2

EPSS

100%

Published

2024-01-31

Updated

2026-05-02

CNA

hackerone

Vendors

Ivanti

2 products

CPEs

cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated