CVE-2024-11772
9.1
CRITICAL · CVSS 3.1 · EPSS 7.7% (pctl 94)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Scoring
| CVSS | 9.1 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 7.65% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2024-12-10 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| ivanti | cloud services appliance |
→ the Explorer · watch your stack · NVD