CVE Watch4 ago 2026

CVE-2024-21887

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CVSS

9.1

Crítico

EPSS

100.0%

p100

KEV

SÍ

10 ene 2024

Exploit Today

0-100

Publicado: 12 ene 2024 · Última mod.: 4 ago 2026 · CWE-77

EPSS · 30d

100.0%EPSS · 30 días100.0%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Ivanti / Connect Secure and Policy Secure

Vulnerabilidad

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Añadido a KEV

10 ene 2024

Remediar antes de

22 ene 2024

Uso conocido en ransomware

Sí

Descripción resumida

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887

Descripción técnica

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-11053610.0 CRÍ

—

——0A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.11h CVE-2026-1012166.6 MED

—

——0Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.15h CVE-2026-1045859.8 CRÍ

52.4%

——16Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.10h CVE-2026-977818.8 ALT

54.8%

——16Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.1d CVE-2026-969518.8 ALT

73.8%

KEV—72Microsoft Windows Command Injection Vulnerability12h CVE-2026-697187.8 ALT

60.9%

——18Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.1d