This vulnerability (CVE-2024-21893) affects the SAML component of Ivanti Connect Secure (ICS) and Ivanti Policy Secure in versions 9.x and 22.x, including Ivanti Neurons for ZTA. It is a server-side request forgery (CWE-918) that enables attackers to bypass authentication and access restricted resources. The CVSS 3.0 base score is 8.2, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact. The affected versions explicitly include =22.6, 9.1R18, and 22.6R2. There is no vendor advisory or patch link provided, and the product is not a cloud service, so remediation status is unknown.

An unauthenticated attacker can exploit this SSRF vulnerability to access restricted resources without proper authentication, potentially exposing sensitive information. The confidentiality impact is high, while integrity impact is low and availability is not affected. This could lead to unauthorized data disclosure within affected Ivanti ICS and Policy Secure deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, organizations should monitor Ivanti's security advisories for updates. Until a fix is available, consider restricting network access to the affected components and closely reviewing access controls to limit exposure.