CVE-2024-8963
Published 2024-09-19 · Updated 2026-06-17 · Source 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Summary
CVE-2024-8963 is a critical-severity (CVSS 9.4) vulnerability in Ivanti Cloud Services Appliance (CSA). CISA added it to the Known Exploited Vulnerabilities catalog on September 19, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 10, 2024. CISA does not currently list it as used in ransomware campaigns. Ivanti has 38 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.
All 38 known-exploited Ivanti vulnerabilities →Description
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA Known-Exploited Vulnerability
Product: Ivanti — Cloud Services Appliance (CSA)
Name: Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Date added: 2024-09-19 · Due: 2024-10-10
Required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.