CVE-2021-44529: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-03-25. EPSS: 99.1% chance of exploitation in the next 30 days.

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

Affected products

• Ivanti Endpoint Manager Cloud Services Appliance: up to and including 4.5; version 4.6 only

Published 2021-12-08. Last modified 2026-08-04.