Ivanti Connect Secure & Policy Secure Command Injection Vulnerability

Critical command injection flaw in Ivanti Connect Secure VPN gateways allowing unauthenticated remote code execution.

EPSS Exploit Probability99.95%

100.0th percentile

Exploit Maturityactive wild

Active Weaponization

Primary VendorsIvanti

1 product(s) impacted

Ransomware CampaignMultiple cybercrime and espionage groups

Threat intel association

CVSS v3.1 Vector Breakdown

Comprehensive attack metric decomposition according to FIRST specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV)NETWORKRemotely exploitable over network

Attack Complexity (AC)LOWNo specialized access needed

Privileges Required (PR)NONEUnauthenticated exploitation

User Interaction (UI)NONEZero-click / autonomous

Scope (S)UNCHANGEDSecurity authority boundary

Confidentiality (C)HIGHTotal information disclosure

Integrity (I)HIGHTotal compromise of system state

Availability (A)HIGHComplete resource denial

TechOverwatch AI Security Sentinel Analysis

Model: Gemini 2.0 Flash Security Sentinel · Generated: 2026-10-28

Executive Defense Summary

Widely weaponized enterprise edge device flaw allowing state actors and ransomware affiliates to bypass authentication, plant persistent webshells, and harvest internal network traffic.

Technical Root Cause Architecture

The API endpoint `/api/v1/license/keys-status/` fails to sanitize user inputs passed into internal python system exec routines. Chaining with the CVE-2023-46805 path traversal bypass removes all authentication barriers.

Exploitation Scenario & Attack Chain

Adversary issues an HTTP GET to `/api/v1/license/keys-status/;[command]` through the path traversal wrapper. The command runs with root privileges on the FreeBSD underlying operating system.

Enterprise Blast Radius & Lateral Risk

Total perimeter breach: theft of VPN session tokens, Active Directory credentials, internal subnet pivoting.

Remediation & Defense Playbook

Immediate actionable steps for DevOps, SecOps, and Security Architects

1Apply Ivanti security patches and run the External Integrity Checker Tool (ICT).

2Revoke all certificates, API keys, and Active Directory credentials passing through the gateway.

3Isolate VPN management interfaces from untrusted external networks.

Detection Guidance & Threat Hunting

Examine ICT logs for mismatched files in `/home/etc/manifest/` and unexpected modifications in `/pkg/do/`.

Sigma Detection Rule (SIEM Export)

title: Ivanti Connect Secure Command Injection
status: critical
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/api/v1/license/keys-status/'
  condition: selection

Affected Software & CPE Matrix

Targeted versions, patched releases, and Common Platform Enumerations

Vendor	Product	Affected Versions	Fixed In
Ivanti	Connect Secure (ICS)	9.x, 22.x prior to security patches	ICS 22.5R2.2 / 22.6R2.1

Official Advisories & Authoritative Sources

Volexity Advisory: Zero-Day Exploitation of Ivanti Connect Securehttps://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/

advisory

CISA Emergency Directive 24-01https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities

cisa

AI Agent & Security Automation Hub

TechOverwatch provides native machine-readable endpoints for autonomous agents, Cursor, Claude, ChatGPT, and automated patch scanners.

Agent CLI Command (curl):

curl -s https://www.techoverwatch.in/api/vulnerabilities/CVE-2024-21887/raw

Raw Markdown JSON API