CVE-2024-22024

—

CVSS 3.1

8.3 high

EPSS

95%p100

Published

Feb 13, 2024 (Feb 13, 2024)

Modified

Jun 17, 2026

Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Vendors: ivanti
Products: connect secure, policy secure, zero trust access gateway
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (94.7%)

In the news8 stories

watchTowr raises $19 million to accelerate global growth

Help Net SecurityOct 10, 00:00 UTC · Oct 10, 2024Exploit / PoC CVE-2024-22024

Five Eyes Agencies Warn of Active Exploitation of Ivanti Gateway Vulnerabilities

The Hacker NewsMar 2, 04:02 UTC · Mar 2, 2024Vulnerability in the wildCVE-2023-46805 CVE-2024-21887 CVE-2024-21888+2 CVEs

Ivanti warns of a new auth bypass flaw in its Connect Secure, Policy Secure, and ZTA gateway devices

Security AffairsFeb 9, 08:17 UTC · Feb 9, 2024Exploit / PoC in the wildCVE-2024-22024 CVE-2023-46805 CVE-2024-21887+2 CVEs

Ivanti publishes urgent warning about new vulnerability

The RecordFeb 8, 22:05 UTC · Feb 8, 2024Vulnerability in the wildCVE-2024-22024