CVE-2024-21887

CWE-77

Critical

99.6

RPS

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Source: NVD

CVSS: 9.1; Critical · v3.1
EPSS: 99.99%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Jan 2024
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-77
Published: 12 Jan 2024; Last modified 4 Aug 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2024-21887

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2024-21887

Description

Signals

Get this score from the API