Ivanti · Cloud Services Appliance (CSA)
CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
What it is
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CISA: Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
What to do
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Deadline for US federal agencies: October 10, 2024
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 9, 2024 | SQL Injection | Cloud Services Appliance (CSA) | Medium 6.5 | 44% |
| Oct 9, 2024 | OS Command Injection | Cloud Services Appliance (CSA) | High 7.2 | 58% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
| May 7, 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | High 7.2 | 34% |
| Apr 8, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Mar 9, 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | High 8.6 | 88% |
| Jan 29, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.