CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection

What is CVE-2024-21887?

CVE-2024-21887 is a critical command injection vulnerability in Ivanti Connect Secure, published on 12 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Weakness: CWE-77

Which versions are affected by CVE-2024-21887?

It affects 2 products.

Products include Ivanti Connect Secure, Ivanti Policy Secure.

How do I fix CVE-2024-21887?

No fix has been published for CVE-2024-21887 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 22 Jan 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-21887 being exploited?

Yes. Attackers have exploited CVE-2024-21887 in the wild since at least 10 Jan 2024, including in ransomware campaigns.

Public exploit code: 2 Metasploit modules, 1 Nuclei template and 8 proofs of concept on GitHub.

Other vulnerabilities in Ivanti Connect Secure

• CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-Free Exploited Critical 10.0
• CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read Exploited Critical 9.9
• CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Exploited Critical 9.0
• CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Exploited Critical 9.0
• CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Exploited High 8.8

All Ivanti Connect Secure vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-87qj-c5f7-6c8q.