CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF)

Exploited in the wild High 8.2 Published 31 Jan 2024 Updated 4 Aug 2026

An attacker can exploit a server-side request forgery in Ivanti Connect Secure to access restricted resources without authentication.

Exploited in the wild: Since 31 Jan 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-21893?

CVE-2024-21893 is a high-severity server-side request forgery vulnerability in Ivanti Connect Secure, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Weakness: CWE-918

Which versions are affected by CVE-2024-21893?

It affects 3 products.

Products include Ivanti Connect Secure, Ivanti Neurons for Zero-Trust Access, Ivanti Policy Secure.

How do I fix CVE-2024-21893?

No fix has been published for CVE-2024-21893 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 Feb 2024.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-21893 being exploited?

Yes. Attackers have exploited CVE-2024-21893 in the wild since at least 31 Jan 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.

All Ivanti Connect Secure vulnerabilities

Sources

Also known as GHSA-5rr9-mqhj-7cr2.