VulnTideExploited vulnerabilities, by vendor. Data as of 28 Oct 2026.
Known exploitedIn CISA's KEV catalog since 31 January 2024Ransomware use: known
Ivanti Connect Secure, Policy Secure, and Neurons

CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 31 Jan 2024, the same day the CVE record was published.

How likely is exploitation in the next 30 days?
100%

EPSS score, percentile 100 of all scored records

How severe?
8.2 High

CVSS v3.0 base score, given by the CNA

What should I do?

CISA deadline 2 Feb 2024. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • 9.1R18 through 9.1R18
  • 22.6R2 through 22.6R2
  • 9.1R18 through 9.1R18
  • 22.6R1 through 22.6R1

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: 2 February 2024.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Ivanti ICS
StatusVersions
Affected9.1R18 through 9.1R18
Affected22.6R2 through 22.6R2

Versions not listed are: unaffected.

Ivanti IPS
StatusVersions
Affected9.1R18 through 9.1R18
Affected22.6R1 through 22.6R1

Versions not listed are: unaffected.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

  • CISA added CVE-2024-21893 to its Known Exploited Vulnerabilities (KEV) catalog on 31 Jan 2024.
  • CISA marks it as known to be used in ransomware campaigns.
  • The due date CISA sets for the required action is 2 Feb 2024.
  • The CVE record was published on 31 Jan 2024, the same day it was added to KEV.
  • The CVE record carries a CVSS v3.0 base score of 8.2 (High), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

  • CWE-918: Server-Side Request Forgery (SSRF)

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
31 Jan 2024CVE record published
31 Jan 2024Added to CISA KEV
2 Feb 2024CISA due date for the required action
4 Aug 2026CVE record last updated

References

More exploited Ivanti vulnerabilities

  • CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (added 13 Oct 2026)
  • CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability (added 11 Jun 2026)
  • CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (added 7 May 2026)
  • CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (added 8 Apr 2026)
  • CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (added 9 Mar 2026)
  • CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (added 29 Jan 2026)