Ivanti · Cloud Services Appliance (CSA)
CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
What it is
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CISA: Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
What to do
As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Deadline for US federal agencies: October 30, 2024
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 9, 2024 | SQL Injection | Cloud Services Appliance (CSA) | Medium 6.5 | 44% |
| Sep 19, 2024 | Path Traversal | Cloud Services Appliance (CSA) | Critical 9.4 | 99% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
| May 7, 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | High 7.2 | 34% |
| Apr 8, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Mar 9, 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | High 8.6 | 88% |
| Jan 29, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.