CVE-2024-9380

Ivanti · Published October 8, 2024

7.2

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

Affected Products

Endpoint Manager Cloud Services Appliance < 5.0.2

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H