CVE-2024-21894: Ivanti Connect Secure

Critical severity, CVSS 9.8. EPSS: 19% chance of exploitation in the next 30 days.

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code

Affected products

• Ivanti Connect Secure: version 9.1 only; version 22.1 only; version 22.2 only; version 22.3 only; version 22.4 only; version 22.5 only; …
• Ivanti Policy Secure: version 9.0 only; version 9.1 only; version 22.1 only; version 22.2 only; version 22.3 only; version 22.4 only; …

Published 2024-04-04. Last modified 2026-06-17.