Ivanti Connect Secure and Policy Secure Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2024. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| connect secure | = 22.1= 22.2= 22.3= 22.4= 22.5= 22.6= 9.0= 9.1 | |
| policy secure | = 22.1= 22.2= 22.3= 22.4= 22.5= 22.6= 9.0= 9.1 |
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free