CVE-2024-39711

criticalpriority · track · 1EPSS 0.017 · 78 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.73% (78th) EPSS

CVSS 9.1 · critical

Is it mine?

28 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedConnect Securecisa_csaf_it
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
FixedPolicy Securecisa_csaf_it
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.09.1criticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.09.1criticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · support@hackerone.comexploitability 2.3 · impact 6

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.19.1criticalAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-88USCWE-88USCWE-88US

affected products (28)

Products and version ranges known to be affected.

Ivanti Connect Secure <22.7R2.3all versionscert_bundDE
Ivanti Policy Secure <22.7R1.2all versionscert_bundDE
Ivanti Secure Access Client <22.7R4all versionscert_bundDE
Ivanti Connect Secure< 22.7R2.3cert_bundDE
Ivanti Policy Secure< 22.7R1.2cert_bundDE
Ivanti Secure Access Client< 22.7R4cert_bundDE
Ivanti Connect Secure 0 < 22.7R2.1all versionscisa_csaf_itUS
Ivanti Connect Secure 0 < 9.1R18.7all versionscisa_csaf_itUS
Ivanti Connect Secure 22.7R2.1all versionsfixedcisa_csaf_itUS
Ivanti Connect Secure 9.1R18.7all versionsfixedcisa_csaf_itUS
Ivanti Policy Secure 0 < 22.7R1.1all versionscisa_csaf_itUS
Ivanti Policy Secure 22.7R1.1all versionsfixedcisa_csaf_itUS
Ivanti Connect Secureall versionsfixedcisa_csaf_itUS
Ivanti Connect Secure< 22.7R2.1cisa_csaf_itUS
Ivanti Connect Secure< 9.1R18.7cisa_csaf_itUS
Ivanti Policy Secureall versionsfixedcisa_csaf_itUS
Ivanti Policy Secure< 22.7R1.1cisa_csaf_itUS
Ivanti Connect Secure22.7R2.1 → 22.7R2.1enisa_euvdEU
Ivanti Connect Secure9.1R18.7 → 9.1R18.7enisa_euvdEU
Ivanti Policy Secure22.7R1.1 → 22.7R1.1enisa_euvdEU

showing 20 of 28

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2024-0442Kwetsbaarheden verholpen in Ivanti Connect Secure en Policy SecureNL2024-11-13csaf · ncsc_nlNL
Ivanti heeft kwetsbaarheden verholpen in Connect Secure en Policy Secure.
VA-24-317-01Ivanti Connect Secure and Ivanti Policy Secure Multiple Vulnerabilities2024-11-13csaf · cisa_csaf_itUS
Ivanti Connect Secure and Ivanti Policy Secure contain multiple vulnerabilities that allow a remote, authenticated attacker to execute arbitrary code. All of the vulnerabilities except for CVE-2024-39709 require the attacker to be authenticated with administrative privileges to the administrative web interface. CVE-2024-39709 requires the attacker to have 'nr' privileges on the underlying Linux operating system. These vulnerabilities are addressed in Ivanti Connect Secure versions 22.6R2, 22.7R2.1, and 9.1R18.7 and Ivanti Policy Secure versions 22.7R1.1 and 22.7R1.2.
WID-SEC-W-2024-3433Ivanti Connect Secure: Mehrere SchwachstellenDeutsch2024-11-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, einen Denial-of-Service Zustand zu erzeugen und Daten zu modifizieren

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_it ncsc_nl NVD CVE.org MITRE

published 2024-11-13modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan