CVE-2024-8190: Ivanti Cloud Services Appliance OS Command Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 3 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 88.5%
EPSS score, percentile 99.8 of all scored records
- How severe?
- 7.2 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline . As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions … Full text
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Unaffected 4.6 Patch 519; 5.0
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190
- https://nvd.nist.gov/vuln/detail/CVE-2024-8190
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | 4.6 Patch 519 |
| Unaffected | 5.0 |
Versions not listed are: affected.
Versions the record lists as unaffected: 4.6 Patch 519, 5.0.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2024-8190 to its Known Exploited Vulnerabilities (KEV) catalog on 13 Sep 2024.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 4 Oct 2024.
- The CVE record was published on 10 Sep 2024, 3 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.2 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 88.5% (percentile 99.8), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Attack patterns (CAPEC)
- CAPEC-88: OS Command Injection
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
More exploited Ivanti vulnerabilities
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
- CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
- CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability