CVE-2024-47906: Ivanti Connect Secure

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

Affected products

• Ivanti Connect Secure: before 9.1 (fixed in 9.1); after 9.1, before 22.7 (fixed in 22.7); version 22.7 only
• Ivanti Policy Secure: before 9.1 (fixed in 9.1); after 9.1, before 22.7 (fixed in 22.7); version 22.7 only

Published 2024-11-12. Last modified 2026-06-17.