Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-21894 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Ivanti Policy Secure. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A heap overflow vulnerability exists in the IPSec component of Ivanti Connect Secure versions 9.x and 22.x as well as Ivanti Policy Secure. The flaw, tracked as CVE-2024-21894, is triggered when the service processes specially crafted network requests and is assigned a CVSS score of 9.8. It is also associated with CWE-787 and CWE-703.
An unauthenticated remote attacker can send malicious requests to the affected gateways, causing the IPSec service to crash and resulting in a denial of service. Under certain conditions the same flaw may permit arbitrary code execution.
Ivanti has published security advisory SA-CVE-2024-21894 (along with related issues CVE-2024-22052, CVE-2024-22053, and CVE-2024-22023) that addresses the heap overflow and provides remediation guidance for Connect Secure and Policy Secure customers.
EPSS for the CVE rose from a low baseline to a peak of 0.1103 on 2025-12-11 before receding to the current value of 0.0794, indicating measurable post-disclosure exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19505
Vulnerability Data
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this…
more
may lead to execution of arbitrary code
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and bounds checks) finds out-of-bounds write flaws before deployment.
Enforces failure to a known state while preserving required properties, limiting impact of unhandled exceptions.
Mandates explicit fail-safe procedures triggered by indicated failures, structurally preventing unhandled exceptional conditions.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Requires application of security engineering principles that include robust exception and error handling during design.
Input validation can structurally reject or sanitize data that would otherwise trigger an out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect and prevent out-of-bounds write defects.
Secure development life cycle mandates practices that prevent out-of-bounds writes.
Application security requirements can specify bounds-checking and safe memory handling.
Secure architecture and engineering principles reduce the likelihood of buffer overflows.
Secure coding directly addresses out-of-bounds writes through language choice and coding standards.
Change management can enforce review gates that catch unsafe memory operations before deployment.