CVE-2023-41724

—

CVSS 3.1

8.8 high

EPSS

13%p96

Published

Mar 31, 2024 (Mar 31, 2024)

Modified

Jun 17, 2026

Description

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

Vendors: ivanti
Products: standalone sentry
Weakness: CWE-77, CWE-94
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (12.8%)

In the news6 stories

Ivanti fixed for 4 new issues in Connect Secure and Policy Secure

Security AffairsApr 4, 08:10 UTC · Apr 4, 2024Exploit / PoC CVE-2024-21894 CVE-2024-22052 CVE-2024-22053+5 CVEs

Ivanti Rushes Patches for 4 New Flaws in Connect Secure and Policy Secure

The Hacker NewsApr 4, 06:30 UTC · Apr 4, 2024Vulnerability CVE-2024-21894 CVE-2024-22052 CVE-2024-22053+3 CVEs

Week in review: Ivanti fixes RCE vulnerability, Nissan breach affects 100,000 individuals

Help Net SecurityMar 24, 00:00 UTC · Mar 24, 2024Vulnerability CVE-2023-41724 CVE-2024-25153 CVE-2024-27198

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

The Hacker NewsMar 22, 03:01 UTC · Mar 22, 2024Vulnerability CVE-2023-41724 CVE-2023-46808 CVE-2023-47479

Ivanti urges customers to fix critical RCE flaw in Standalone Sentry

Security AffairsMar 21, 09:59 UTC · Mar 21, 2024Vulnerability CVE-2023-41724 CVE-2023-46805 CVE-2024-21887+1 CVEs

Ivanti fixes RCE vulnerability reported by NATO cybersecurity researchers (CVE-2023-41724)

Help Net SecurityMar 20, 00:00 UTC · Mar 20, 2024Vulnerability in the wildCVE-2023-41724 CVE-2023-46808