The most damaging vulnerabilities are often not one bug but two, where a modest flaw and a serious flaw combine into something worse than either alone. CVE-2024-21887 is the serious half of exactly such a chain in Ivanti Connect Secure and Ivanti Policy Secure. On its own it is a post-authentication command injection rated CVSS 3.1 9.1 (Critical). Chained with the authentication bypass CVE-2023-46805, it becomes unauthenticated remote code execution on an internet-facing VPN gateway.
ID and severity
CVE-2024-21887 is a command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x). By design it requires an authenticated administrator, but its CVSS score of 9.1 reflects the full compromise it enables. The paired vulnerability, CVE-2023-46805, is an authentication bypass in the same web component rated CVSS 8.2 (High). Used together, the auth bypass removes the "authenticated" precondition, and the command injection provides code execution, so the chain is effectively unauthenticated RCE.
Timeline and impact
Ivanti and Volexity disclosed both vulnerabilities on January 10, 2024, and Volexity reported that active exploitation had begun as early as December 2023, attributed initially to a suspected state-aligned actor. At disclosure, Ivanti offered a mitigation (an importable XML configuration) rather than a full patch. The first patches began rolling out at the end of January 2024, and Ivanti staged fixes across releases over the following weeks. CISA issued emergency guidance and later ordered federal agencies to disconnect affected Ivanti products, an unusually forceful step.
Exploitation quickly broadened from a single sophisticated actor to widespread opportunistic attacks once proof-of-concept details circulated, with Volexity and others reporting thousands of compromised appliances. As with other VPN gateway incidents, the appeal is obvious: the device sits at the perimeter, is trusted for remote access, and terminates encrypted tunnels into the internal network.
Root cause
Ivanti Connect Secure exposes a set of web endpoints for its administrative and gateway functionality. Two independent weaknesses lined up:
The authentication bypass (CVE-2023-46805) let a remote attacker reach protected endpoints without valid credentials. The web component performed authorization checks that could be evaded through a path-handling flaw, so requests that should have been rejected were processed as if authorized.
The command injection (CVE-2024-21887) lived in an endpoint that constructed a system command from request parameters without safe argument handling. An administrator (or, via the bypass, an attacker impersonating one) could supply a parameter containing shell metacharacters that were passed into a command interpreter.
A safe, high-level illustration of the chain, kept in a code fence so the metacharacters are not interpreted:
# step 1: reach a protected admin endpoint without auth (CVE-2023-46805)
GET /path/that/evades/authorization/check
# step 2: inject a command via an unsanitized parameter (CVE-2024-21887)
POST /admin/endpoint param=value; malicious-command
The structural lesson repeats across VPN and gateway appliances: a rich, network-exposed web management layer, an authorization gap, and a command construction that trusts input. Neither bug alone is a catastrophe; together they are.
Detection
- Inventory all Ivanti Connect Secure and Policy Secure gateways and record exact versions (9.x and 22.x are affected).
- Run Ivanti's external Integrity Checker Tool against each appliance; note that early versions of the checker were themselves bypassed by attackers, so use the current tooling and corroborate with independent indicators.
- Review web request logs for the authorization-evasion path patterns and for command-injection payloads in administrative endpoint parameters around and after December 2023.
- Hunt for known post-exploitation artifacts: web shells and modified system files documented by Volexity, Mandiant, and CISA, and unexpected outbound connections. Given documented attempts to tamper with forensic tooling, assume a determined adversary and corroborate findings.
Remediation and patched versions
Apply Ivanti's patches, which were released in stages beginning at the end of January 2024. Fixed Connect Secure releases include 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, and 22.5R2.2, with corresponding fixes for Policy Secure and ZTA gateways; consult Ivanti's advisory for the exact build matching your version. Before patches were available, Ivanti's interim step was importing the mitigation configuration file.
Critically, Ivanti and CISA advised that patching alone was not enough for compromised appliances. The recommended path was to factory reset the appliance before applying the patch, then rotate all secrets, certificates, and credentials the gateway had access to, because attackers had established persistence and harvested configuration data. Treat any exposed, unpatched appliance as presumed compromised and hunt for lateral movement.
How Safeguard helps
A VPN appliance is not something you rebuild through a package manifest, but the discipline that shortens exposure to a chained zero-day like this is exactly what supply chain security enforces: know every version-pinned component you run and rank it against live exploitation. Safeguard's software composition analysis inventories the components across your build and deployment artifacts and correlates them with the CISA KEV catalog, so a known-exploited chain is escalated the day it is confirmed. The Safeguard CLI turns that into a hard CI/CD gate for the services you ship, and for the dependencies you own directly, auto-fix opens the upgrade as a review-and-merge pull request instead of a manual scramble. If you want to compare this exploitation-aware prioritization with your current scanner, the Safeguard vs Snyk breakdown is a useful reference, and teams sizing it up can review the pricing page.
When two bugs chain into unauthenticated RCE at the perimeter, the response clock starts the moment the advisory drops, so day-one visibility is everything. Get started free or read the documentation.
Frequently Asked Questions
What is CVE-2024-21887?
It is a command injection vulnerability in the web components of Ivanti Connect Secure and Ivanti Policy Secure that lets an authenticated administrator run arbitrary commands on the appliance. It is rated CVSS 9.1 (Critical), and when chained with the authentication bypass CVE-2023-46805 it becomes unauthenticated remote code execution.
How does the CVE-2024-21887 and CVE-2023-46805 chain work?
CVE-2023-46805 (CVSS 8.2) lets an attacker bypass authentication and reach protected endpoints, and CVE-2024-21887 (CVSS 9.1) lets a request inject shell commands into a system call. Combined, the auth bypass satisfies the "authenticated" precondition of the command injection, giving a remote, unauthenticated attacker code execution on the gateway.
Which Ivanti versions are affected and which are patched?
The vulnerabilities affect Ivanti Connect Secure and Policy Secure versions 9.x and 22.x. Patches were released in stages from late January 2024, with fixed Connect Secure builds including 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, and 22.5R2.2 and corresponding Policy Secure and ZTA fixes. Check Ivanti's advisory for the exact build for your version.
Is patching enough, or do I need to rebuild the appliance?
Patching alone is not sufficient for a compromised appliance. Ivanti and CISA advised performing a factory reset before patching and then rotating all secrets, certificates, and credentials the gateway had access to, because attackers established persistence and harvested configuration data. Any exposed, unpatched appliance should be treated as presumed compromised.
