CVE-2024-21893

Deeper analysis

CVE-2024-21893 is a server-side request forgery vulnerability (CWE-918) residing in the SAML component of Ivanti Connect Secure versions 9.x and 22.x, Ivanti Policy Secure versions 9.x and 22.x, and Ivanti Neurons for ZTA. The flaw carries a CVSS 3.1 score of 8.2 and permits an unauthenticated attacker to reach restricted resources that should otherwise be inaccessible.

An attacker can exploit the issue over the network without credentials or user interaction to issue crafted requests from the affected server, resulting in high-impact confidentiality exposure combined with limited integrity effects. Because the vulnerability requires no authentication, remote adversaries, including automated scanners and threat actors, can target exposed Ivanti appliances directly.

Ivanti security advisories referenced in the supplied links address related issues in the same product families and direct customers to apply vendor-supplied patches. The CVE is also catalogued in CISA’s Known Exploited Vulnerabilities list, confirming that mitigation through updates or compensating controls is required for affected deployments.

The associated EPSS score has reached a peak of 0.9640 with a current value of 0.9432, indicating sustained and widespread exploitation interest following disclosure.