CVE-2021-44529

What it actually does

CVE-2021-44529 is an unauthenticated remote code execution vulnerability in Ivanti Endpoint Manager Cloud Services Appliance. A network-accessible attacker can inject code through the appliance’s web-exposed service and cause the server to execute arbitrary commands with the privileges of the low-privileged web/application account, commonly equivalent to `nobody`. Although initial execution is not root, the attacker can still read accessible data, write files in permitted locations, establish persistence within writable paths, proxy through the appliance, steal configuration material available to the service account, and attempt local privilege escalation or lateral movement.

Why it matters to the business

A compromised Ivanti EPM CSA can become an attacker-controlled entry point into endpoint management infrastructure. Because these appliances often broker access between external clients and internal management services, exploitation can lead to disruption of endpoint operations, credential theft, unauthorized access to managed systems, data exposure, and ransomware deployment. This vulnerability is listed in CISA KEV, is associated with ransomware activity, has very high exploitation likelihood, and the CISA remediation deadline of 2024-04-15 has passed, so any exposed or unremediated instance should be treated as urgent.

How an attack unfolds

An attacker identifies an internet-facing Ivanti Endpoint Manager Cloud Services Appliance and sends a crafted unauthenticated HTTP request to the vulnerable service. The appliance improperly handles attacker-controlled input and executes injected code on the server. Initial commands run with limited web-service privileges, but that is typically enough to enumerate the host, read accessible configuration files, test outbound connectivity, and download additional tooling. The attacker may then place a web shell or other executable in a writable directory, run reconnaissance commands, harvest credentials or tokens accessible to the service account, pivot through the appliance toward internal systems, and attempt privilege escalation. In ransomware-driven intrusions, the appliance is commonly used as the initial foothold before broader discovery, credential theft, lateral movement, and encryption or extortion activity.

How to fix it

Apply the vendor-recommended Ivanti remediation for the affected Endpoint Manager Cloud Services Appliance and upgrade to a supported, fixed release. No exact fixed version was provided in the input, so administrators should consult the current Ivanti advisory for CVE-2021-44529 and deploy the latest supported CSA version or replacement build. If immediate upgrade is not possible, remove the appliance from direct internet exposure, restrict access to trusted VPN or management networks, enforce allowlisting at firewalls and reverse proxies, disable unused services, rotate credentials and secrets stored on or used by the appliance, and increase logging. Because this vulnerability is KEV-listed and associated with ransomware, mitigation-only approaches should be temporary; exposed systems should be patched or retired as soon as possible.

How to confirm the fix worked

Confirm the installed Ivanti CSA version and build are no longer affected according to Ivanti’s advisory. Validate from an external perspective that the appliance is not publicly reachable except through approved access controls. Review configuration to ensure only trusted networks can reach administrative and service interfaces. Run authenticated vulnerability scanning where supported and compare results against the patched build. Confirm that web/application services were restarted after patching and that no unexpected files, scheduled jobs, service changes, or unknown user accounts remain. For appliances that were exposed before remediation, perform compromise assessment rather than relying only on version validation.

Typical attack path

1. Scan for externally reachable Ivanti EPM Cloud Services Appliance services.
2. Fingerprint the appliance and identify vulnerable or unsupported versions.
3. Send a crafted unauthenticated HTTP request that triggers server-side code injection.
4. Execute basic reconnaissance commands as the low-privileged web/application user.
5. Download or stage a web shell, reverse shell, or post-exploitation tool in a writable directory.
6. Harvest accessible configuration files, credentials, tokens, logs, or appliance trust material.
7. Attempt local privilege escalation or use the appliance as a pivot into internal management networks.
8. Establish persistence, disable or evade logging where possible, and continue lateral movement.
9. In ransomware-motivated campaigns, use the foothold to support credential theft, data exfiltration, and eventual disruptive payload deployment.

How to detect it

Investigate historical exposure as well as current compromise. Review appliance web access logs, web error logs, application logs, system logs, auditd or EDR telemetry, shell history where available, cron/systemd changes, file integrity data, DNS logs, proxy logs, firewall logs, and NetFlow. Look for unauthenticated requests containing command separators, shell metacharacters, URL-encoded commands, base64 payloads, or attempts to invoke common interpreters and download utilities. Correlate web requests with process execution where the web server or application service spawns `sh`, `bash`, `python`, `perl`, `php`, `curl`, `wget`, `nc`, `ncat`, `openssl`, or similar tools. Hunt for files created by the `nobody` or web-service account in writable directories such as `/tmp`, `/var/tmp`, `/dev/shm`, and web-accessible directories. Investigate outbound connections from the appliance to unfamiliar IP addresses, especially immediately after suspicious HTTP requests. Because this vulnerability has ransomware relevance, also search for post-exploitation behaviors including credential access, internal network scanning, remote administration tooling, archive creation, unusual SMB/RDP/SSH activity, and staging of large files for exfiltration.

• nobody.*sh -c
• nobody.*bash -c
• nobody.*curl
• nobody.*wget
• nobody.*python
• nobody.*perl
• nobody.*php
• nobody.*nc
• nobody.*ncat
• nobody.*openssl s_client
• httpd.*sh -c
• httpd.*bash -c
• apache.*sh -c
• apache.*bash -c
• php-fpm.*sh -c
• php-fpm.*bash -c
• /tmp/.*\.sh
• /var/tmp/.*\.sh
• /dev/shm/.*
• chmod +x /tmp/
• chmod +x /var/tmp/
• chmod +x /dev/shm/
• curl http://
• wget http://
• curl -k https://
• wget --no-check-certificate
• /bin/sh -i
• bash -i >&
• python -c 'import pty'
• perl -e 'use Socket'
• nc -e /bin/sh
• ncat -e /bin/sh
• /etc/cron.d/.*nobody
• crontab.*curl
• crontab.*wget
• uid=99(nobody)
• uid=65534(nobody)

What your security team should do

• Treat any internet-exposed affected Ivanti EPM CSA as high priority due to active exploitation, KEV status, high EPSS, and ransomware association.
• Patch or upgrade to the current vendor-supported fixed release; if unsupported, replace or decommission the appliance.
• Immediately restrict network access to the CSA to trusted sources only and remove unnecessary public exposure.
• Perform threat hunting for prior exploitation before and after remediation, focusing on web logs, process execution, suspicious downloads, and files owned by the web-service account.
• Rotate credentials, API keys, certificates, and secrets that may have been stored on or accessible from the appliance.
• Check for lateral movement from the appliance into endpoint management, directory, VPN, file-sharing, and administrative networks.
• Preserve relevant logs and forensic artifacts before rebuilding or reimaging any suspected compromised appliance.
• If evidence of exploitation exists, initiate incident response procedures and assess for ransomware precursor activity such as credential dumping, discovery, remote administration tools, and bulk file access.