CVE-2024-9380

KEVIvanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

Description

Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.

An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

PublishedOct 8, 2024

Last modifiedJun 17, 2026

Added to KEVOct 9, 2024

Remediation dueOct 30, 2024

References

forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9380US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 726 days
CVSS: 7.2 HIGH
EPSS (30-day exploit probability): 58.3% · top 1% of all CVEs
Weakness: CWE-77
Attack vector: Network, remotely reachable

Recommended actions

1.As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.