This vulnerability (CVE-2024-21887) exists in the web components of Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure (versions 9.x and 22.x). An authenticated administrator can exploit a command injection flaw by sending specially crafted requests, resulting in arbitrary command execution on the appliance. The flaw is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.0 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to execute arbitrary commands on the affected appliance, potentially leading to full system compromise. This impacts the confidentiality, integrity, and availability of the device and its managed environment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity. Follow Ivanti's official guidance once published.