CVE-2024-11639
10.0
CRITICAL · CVSS 3.1 · EPSS 4.9% (pctl 92)
In your normal cycle
Critical by CVSS (10), but no sign of active exploitation.
Description
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 4.87% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-288 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2024-12-10 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| ivanti | cloud services appliance |
→ the Explorer · watch your stack · NVD