VulnSocial

CVE-2024-21893Active Exploitation(ivanti / connect_secure)

LOWCVSS 8.2 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (6 mentions)

Immediate actions

  • Prioritize remediation for ivanti connect_secure systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

ivanti CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-02-02. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • connect_secure
  • neurons_for_zero-trust_access
  • policy_secure

Threat summary

  • Active exploitation appears in 6 classified signals
  • 6 mentions across 1 observed day

What's happening

  • Active exploitation reported across 6 signals
  • 6 total mentions across 1 day

Affected systems

Vendors
ivanti
Products
connect_secureneurons_for_zero-trust_accesspolicy_secure

11 versions affected across 3 products

Deep dive

Activity timeline6 mentions / 1d
02356Mentions · 2026-05-04: 6Active Exploitation · 2026-05-04: 605-04
Signal classification1 categories
Active Exploitation
6100.0%
Referenced assets1 URL
Full discourse6 posts
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    00:14 UTC: Thread live on @lyrie_ai. CVE-2024-21893 added to CISA KEV: Ivanti Connect Secure, Policy Secure, and Neurons

    Post summary

    CVE-2024-21893 is now on the CISA Known Exploited Vulnerabilities list for Ivanti Connect Secure, Policy Secure, and Neurons, indicating it is actively exploited in the wild.

    2000043
    152 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    00:11 UTC: GPT-5 enrichment complete. 100 words. 3 citations. CVE-2024-21893 added to CISA KEV: Ivanti Connect Secure, Policy Secure, and Neurons

    Post summary

    CVE-2024-21893 was added to the CISA KEV list, indicating that this vulnerability is currently being exploited in the wild.

    1000042
    152 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    03:00 UTC: First exploit attempt in the wild. CVE-2024-21893 added to CISA KEV: Ivanti Connect Secure, Policy Secure, and Neurons

    Post summary

    The post reports the first known exploitation of CVE-2024-21893, adding it to the CISA KEV list, but does not provide details about the vulnerability, PoC, or patch.

    1000050
    152 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    00:00 UTC: CVE-2024-21893 disclosed. CISA: CVE-2024-21893 added to Known Exploited Vulnerabilities — Ivanti Connect Secure, Policy Secure, and Neurons

    Post summary

    CISA lists CVE-2024-21893 as a known exploited vulnerability for Ivanti Connect Secure, Policy Secure, and Neurons, indicating active exploitation in the wild.

    1000043
    152 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    00:03 UTC: Lyrie Sentinel flagged it. CVE-2024-21893 added to CISA KEV: Ivanti Connect Secure, Policy Secure, and Neurons

    Post summary

    CVE-2024-21893, affecting Ivanti Connect Secure, Policy Secure, and Neurons, is listed on the CISA KEV, indicating it is being actively exploited in the wild.

    1000039
    152 followersView on X
  • Lyrie.ai@lyrie_ai
    Active Exploitation

    https://lyrie.ai/research/research/active-exploit-cve-2024-21893-connect-secure-policy-secure-and-neurons #lyrie #cybersecurity #CVE #threatintel #zerodayattack

    Post summary

    The provided text references an article titled "active-exploit‑cve‑2024‑21893", implying that CVE-2024-21893 is being exploited in the wild, but no other specific details or mitigations are disclosed.

    0000025
    152 followersView on X
CPE platform detail118 entries

118 of 118 entries

PartVendorProductVersionTarget SWTarget HW
Appivanticonnect_secure21.12--
Appivanticonnect_secure21.9--
Appivanticonnect_secure22.1--
Appivanticonnect_secure22.1--
Appivanticonnect_secure22.2--
Appivanticonnect_secure22.2--
Appivanticonnect_secure22.3--
Appivanticonnect_secure22.4--
Appivanticonnect_secure22.4--
Appivanticonnect_secure22.6--
Appivanticonnect_secure22.6--
Appivanticonnect_secure22.6--
Appivanticonnect_secure22.6--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.0--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivantineurons_for_zero-trust_access---
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.3--
Appivantineurons_for_zero-trust_access22.3--
Appivantineurons_for_zero-trust_access22.4--
Appivantineurons_for_zero-trust_access22.4--
Appivantineurons_for_zero-trust_access22.5--
Appivantineurons_for_zero-trust_access22.5--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantipolicy_secure22.1--
Appivantipolicy_secure22.1--
Appivantipolicy_secure22.2--
Appivantipolicy_secure22.2--
Appivantipolicy_secure22.3--
Appivantipolicy_secure22.3--
Appivantipolicy_secure22.4--
Appivantipolicy_secure22.4--
Appivantipolicy_secure22.4--
Appivantipolicy_secure22.5--
Appivantipolicy_secure22.6--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.0--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--
Appivantipolicy_secure9.1--

Explore more

Back to dashboardivanti CVEsconnect_secure vulnerabilities