CVE-2024-21888: Ivanti Connect Secure

High severity, CVSS 8.8. EPSS: 85.4% chance of exploitation in the next 30 days.

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only; version 21.9 only; version 21.12 only; version 22.1 only; version 22.2 only; …
• Ivanti Policy Secure: version 9.0 only; version 9.1 only; version 22.1 only; version 22.2 only; version 22.3 only; version 22.4 only; …

Published 2024-01-31. Last modified 2026-06-17.