CVE-2024-21888highobserved exploitationCWE-269

CVE-2024-21888: high-severity vulnerability in Ivanti ICS

Published · Updated

Follow this CVE+ Monitor ICS+ Monitor IPS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has an official Brazilian government alert.

ssvc Actcvss 8.8epss 85%
from disclosure to weapon
Published on NVDJan 31
VulnCheck+29d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 02/2024Atualizações sobre vulnerabilidades em produtos Volexity Ivantiread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · ICSIvanti · IPS
Related CVEs — Ivanti ICS

In the same product, most dangerous first.

CVE-2024-21893HIGHCVE-2024-21893EPSS 100.0%KEVCVE-2024-21887CRITICALCVE-2024-21887EPSS 100.0%KEVCVE-2023-46805HIGHCVE-2023-46805EPSS 100.0%KEVCVE-2024-22024HIGHCVE-2024-22024EPSS 94.7%