CVE-2024-7593
Published 2024-08-13 · Updated 2026-06-17 · Source 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Summary
CVE-2024-7593 is a critical-severity (CVSS 9.8) vulnerability in Ivanti Virtual Traffic Manager. CISA added it to the Known Exploited Vulnerabilities catalog on September 24, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 15, 2024. CISA does not currently list it as used in ransomware campaigns. Ivanti has 38 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.
All 38 known-exploited Ivanti vulnerabilities →Description
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Ivanti — Virtual Traffic Manager
Name: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Date added: 2024-09-24 · Due: 2024-10-15
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.