Article
Salt Typhoon: what telecom customers should do
Salt Typhoon breached telecom networks through known flaws. What customers and CISOs should ask carriers and check on their own routers and edge devices.
Read more
Exploited vulnerability
Ivanti command injection (CVE-2024-21887)
CVE-2024-21887
CVE-2024-21887 is a command injection flaw in the web components of Ivanti Connect Secure and Ivanti Policy Secure.
- On CISA KEV
- CVE ID
- CVE-2024-21887
- CISA KEV
- Listed
- Affected product
- Connect Secure and Policy Secure
- Exploited
- Yes
- Published
- January 2024
In short
CVE-2024-21887 is a command injection flaw in the web components of Ivanti Connect Secure and Ivanti Policy Secure. On its own it needs an administrator login. Chained with CVE-2023-46805, which removes that need, CISA says it lets an attacker run commands on the appliance.
- CVECVE-2024-21887
- ProductIvanti Connect Secure and Policy Secure
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedRun the integrity checker · Hunt on connected systems
What it allows
NVD describes this as a command injection in the web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x). An authenticated administrator can send specially crafted requests and run arbitrary commands on the appliance. NVD scores it 9.1 (CVSS 3.1, critical): network access, high privileges required, a changed scope and a high impact on confidentiality, integrity and availability. The high privilege requirement is what the authentication bypass CVE-2023-46805 removes. Used together, CISA says a threat actor can run arbitrary commands on a vulnerable product, move sideways, steal data and keep access.
Who is affected
Per Ivanti's information as relayed by CISA and NVD, Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure are affected. Connect Secure was formerly known as Pulse Connect Secure.
Ivanti released information on both flaws on 10 January 2024. CISA added both to its Known Exploited Vulnerabilities catalog the same day, with a due date of 22 January 2024. The catalog marks known ransomware campaign use as Known.
On 19 January 2024 CISA issued Emergency Directive 24-01, ordering federal agencies to act. CISA said it had observed widespread and active exploitation by multiple threat actors, who used the flaws to capture credentials and drop webshells (small tools that give remote control of a server).
In its later updates, CISA said defenders should assume a skilled attacker may hide persistence that survives a factory reset. On 8 February 2024 Ivanti released new updates that replace earlier ones and also fix a third flaw, CVE-2024-22024.
What to do
-
Update to the latest Ivanti release
Ivanti replaced its January 31 and February 1, 2024 updates with new ones on February 8, 2024, which also fix a third flaw, CVE-2024-22024. Use the current supported release from the Ivanti download portal, not the earlier temporary fix.
-
If you only applied the temporary fix, do more
The early mitigation was an XML file imported into the product. It does not remove an existing compromise. CISA also notes it degrades some management features, so follow Ivanti's instructions closely.
-
Run the integrity checker
Run Ivanti's External Integrity Checker Tool, even on newer versions that have an internal checker. CISA says to assume a skilled attacker may hide persistence that survives a factory reset.
-
Rotate everything the appliance could see
After a rebuild, reset the admin password, stored API keys and local user passwords. CISA says to assume domain accounts linked to the product are compromised, and to reset passwords twice and revoke Kerberos tickets.
-
Hunt on connected systems
Keep hunting on systems connected to the appliance, watch the authentication services it exposes, and audit privileged accounts.
Questions
What is CVE-2024-21887?
It is a command injection flaw in the web components of Ivanti Connect Secure and Policy Secure. On its own it needs an administrator login, and it can be reached over the internet.
Why is CVE-2024-21887 dangerous with CVE-2023-46805?
The authentication bypass CVE-2023-46805 removes the need for a login. Together, CISA says a threat actor can run arbitrary commands, move sideways, steal data and keep access. The bypass has its own page.
What did CISA order for this Ivanti flaw?
On 19 January 2024 CISA issued Emergency Directive 24-01, ordering federal agencies to act. It had seen widespread exploitation by multiple threat actors who captured credentials and dropped webshells.
How do I fix CVE-2024-21887?
Use the current supported Ivanti release from 8 February 2024, not the earlier temporary XML mitigation. Run the External Integrity Checker Tool, rotate credentials, and hunt on connected systems.
In our research
- Salt Typhoon: what telecom customers should do October 2026
- DragonForce Ransomware: From Hacktivism to High-Street Extortion September 2025
Sources
- Emergency Directive 24-01 CISA
- CVE-2024-21887 record NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog (JSON feed) CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.