CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote…

Critical · published October 18, 2024

Patch now

High probability of exploitation

CVSS calls it critical at 9.1. It sits in the 99.4th percentile for exploit probability.

CVSS v3.0

9.1

EPSS

71%

Percentile

99.4

In the wild

Unconfirmed

What it is

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.

The record

Technical detail

CVSS v3.0: 9.1 · CRITICAL
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.70955 · 99.4th percentile
Published: 2024-10-18T23:06Z

EPSS history

Timeline

18 OCT 23:06Z
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote…
cvelistv5