CVE-2024-9380
Published 2024-10-08 · Updated 2026-06-17 · Source 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Summary
CVE-2024-9380 is a high-severity (CVSS 7.2) vulnerability in Ivanti Cloud Services Appliance (CSA). CISA added it to the Known Exploited Vulnerabilities catalog on October 9, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 30, 2024. CISA does not currently list it as used in ransomware campaigns. Ivanti has 36 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.
All 36 known-exploited Ivanti vulnerabilities →Description
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Ivanti — Cloud Services Appliance (CSA)
Name: Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Date added: 2024-10-09 · Due: 2024-10-30
Required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.