CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

KEV 2024-01-10
4 days →First PoC 2024-01-14
829 days →Metasploit 2026-04-22
178 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2024-01-10 · due 2024-01-22 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

11 known · links only

GitHub PoCs · by trust, then stars8

Chocapikk/CVE-2024-21887 ↗Trust ok 100
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
★ 58 · created 2024-01-16
duy-31/CVE-2023-46805_CVE-2024-21887 ↗Trust ok 100
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
★ 23 · created 2024-01-16
seajaysec/Ivanti-Connect-Around-Scan ↗Trust ok 100
Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.
★ 12 · created 2024-01-19
oways/ivanti-CVE-2024-21887 ↗Trust ok 100
POC Checker for ivanti CVE-2024-21887 Command injcetion
★ 7 · created 2024-01-14
Hexastrike/Ivanti-Connect-Secure-Logs-Parser ↗Trust ok 100
A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.
★ 6 · created 2025-01-19
raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887 ↗Trust ok 100
The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.
★ 5 · created 2024-01-18
rxwx/pulse-meter ↗Trust ok 100
Parses the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
★ 1 · created 2025-01-14
pwniel/ivanti_shell ↗Trust ok 100
CVE-2024-21887 Exploitation with Ngrok Reverse Shell
★ 0 · created 2024-02-24

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit2

Ivanti Connect Secure Unauthenticated Remote Code Execution ↗
This module chains an authentication bypass vulnerability (CVE-2023-46805) and a command injection vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and 22.x prior to the vendor mitigation are vulnerable. It is unknown if unsupported versions 8.x and below are also vulnerable.
ruby · seen 2026-10-18
Ivanti Connect Secure Unauthenticated Remote Code Execution ↗
This module chains a server side request forgery (SSRF) vulnerability (CVE-2024-21893) and a command injection vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and 22.x are vulnerable, prior to the vendor patch released on Feb 1, 2024. It is unknown if unsupported versions 8.x and below are also vulne
ruby · seen 2026-10-18

Nuclei1

Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection ↗
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
yaml · seen 2026-10-18

Detections

3 rules · Sigma · QRadar · Cortex

CVE exploitation
CVE-2024-21887 exploitation attempt
CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA
T1190conf 90SIG AQL XQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

WARP PANDA
1. “Table 1. Vulnerabilities exploited by WARP PANDA Vulnerability Description CVE-2024-21887 and CVE-2023-46805”
  cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17
UNC5337
1. “UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.”
  cited as exploiting · source: cloud.google.com ↗ · 2026-10-17
UNC5330
1. “UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024.”
  cited as exploiting · source: cloud.google.com ↗ · 2026-10-17
UTA0178
1. “UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023.”
  cited as exploiting · source: cloud.google.com ↗ · 2026-10-17
2. “The threat actors utilize an exploit chain that consists of an authentication bypass vulnerability (CVE-2023-46805) and a code injection flaw (CVE-2024-21887) to take control of the targeted instances.”
  cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17
UNC5325
1. “details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887 by a suspected China-nexus espionage actor that Mandiant tracks as UNC5325.”
  cited as exploiting · source: cloud.google.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals