[Update] Multiple vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (January 11, 2024)
[Update on March 4, 2024] Ivanti published resolution recommendations for Ivanti Connect Secure or Policy Secure in virtual machine [16] on February 29. [Update on February 15, 2024] the vendor released patches for the following versions, which do not...
CSIRTS triage
- What
- Multiple vulnerabilities exist in Ivanti Connect Secure and Policy Secure Gateways.
- Who is affected
- Deployments of Ivanti Connect Secure and Policy Secure Gateways are affected.
- Urgency
- Remediation is urgent due to confirmed exploitation of the vulnerabilities.
- Action
- Apply the patches released by Ivanti for the affected products.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Connect Secure
Get an email when a new Connect Secure advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-001/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation likely imminentCVE-2024-21888EPSS puts this in the most-targeted tier (86.8% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Exploitation likely imminentCVE-2024-21893EPSS puts this in the most-targeted tier (100.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Exploitation likely imminentCVE-2023-46805EPSS puts this in the most-targeted tier (100.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Exploitation likely imminentCVE-2024-21887EPSS puts this in the most-targeted tier (100.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Exploitation likely imminentCVE-2024-22024EPSS puts this in the most-targeted tier (94.7% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2024-21888 | coverage & exploitation status | NVD · CVE.org |
| CVE-2024-21893 | coverage & exploitation status | NVD · CVE.org |
| CVE-2023-46805 | coverage & exploitation status | NVD · CVE.org |
| CVE-2024-21887 | coverage & exploitation status | NVD · CVE.org |
| CVE-2024-22024 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerabi…cisa-kev
- criticalexploitedCVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerabilitycisa-kev
- criticalexploitedCVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerabilitycisa-kev
Recent advisories for Ivanti Connect Secure
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabili…cisa-kev · 2025-04-04
- criticalexploitedCVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilit…cisa-kev · 2025-01-08
- criticalexploitedCVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerabi…cisa-kev · 2024-01-31
- criticalexploitedCVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerabilitycisa-kev · 2024-01-10
- criticalexploitedCVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerabilitycisa-kev · 2024-01-10
- criticalexploitedCVE-2021-22893: Ivanti Pulse Connect Secure Use-After-Free Vulnerabilitycisa-kev · 2021-11-03
More from CERT-FR Alertes de sécurité
- unknown[Update] Vulnerability in Microsoft Exchange Server (May 15, 2026)2026-05-15
- unknownVulnerability in F5 BIG-IP Access Policy Manager (March 31, 2026)2026-03-31
- unknownAlert note – Targeting instant messaging accounts (March 20, 2026)2026-03-20
- unknown[Update] Vulnerability in Cisco Catalyst SD-WAN (February 25, 2026)2026-02-25
- unknown[Update] Multiple vulnerabilities in Ivanti Endpoint Manager Mobile (January 30, 2026)2026-01-30