CVE-2024-37404

What it actually does

This vulnerability is an improper input validation flaw in the administrative portal of Ivanti Connect Secure and Ivanti Policy Secure. A remote attacker who can authenticate to the admin interface can submit crafted input that is processed unsafely by the appliance, allowing arbitrary code execution in the context of the vulnerable service. Because these products are security gateways, successful exploitation can give an attacker control over a perimeter device, enabling command execution, persistence, credential theft, traffic inspection, or pivoting into internal networks. The CVSS score of 8.8 and high EPSS score indicate a high-likelihood, high-impact issue, and the exploit maturity is reported as weaponized.

Why it matters to the business

Compromise of a VPN or policy enforcement appliance can create a serious operational and security incident because these systems often protect remote access, enforce network policy, and sit at the boundary between the internet and internal resources. An attacker with administrative portal access could use this flaw to take over the appliance, disrupt remote access services, steal credentials or session material, alter security policy, and use the device as a trusted foothold for lateral movement. Although this issue is not currently listed in CISA KEV and is not identified as ransomware-associated, the weaponized exploit status and high EPSS score make timely remediation important, especially for internet-exposed administrative portals.

How an attack unfolds

An attacker first obtains valid credentials for the Ivanti administrative portal through phishing, credential theft, password reuse, prior compromise, or abuse of an overprivileged account. The attacker then accesses the vulnerable admin interface and submits specially crafted input to a portal function affected by improper validation. The appliance processes that input in a way that permits remote code execution. After code execution is achieved, the attacker may run reconnaissance commands, create or modify administrative accounts, deploy web shells or other persistence mechanisms, collect configuration and authentication material, tamper with logs, and pivot from the appliance toward internal systems reachable through the VPN or policy enforcement plane.

How to fix it

Upgrade affected products to fixed versions immediately. Ivanti Connect Secure should be upgraded to 22.7R2.1 or later, or 9.1R18.9 or later for the 9.1 release line. Ivanti Policy Secure should be upgraded to 22.7R1.1 or later. If immediate upgrade is not possible, restrict access to the administrative portal to dedicated management networks or VPN-only administrative access, enforce strong multifactor authentication for all administrative users, review and reduce administrative privileges, rotate credentials, and monitor the appliance closely for suspicious activity. Do not rely on network restrictions as a permanent substitute for patching because exploitation requires authentication but may follow credential theft.

How to confirm the fix worked

Confirm the deployed product and build number from the appliance management interface or supported command-line/version reporting mechanism and verify it is at or above the fixed release: Ivanti Connect Secure 22.7R2.1, Ivanti Connect Secure 9.1R18.9, or Ivanti Policy Secure 22.7R1.1. Validate that administrative portals are not exposed broadly to the internet and are reachable only from approved management sources. Review administrative account lists, role assignments, authentication settings, and recent configuration changes after patching. Where available, run vendor-provided integrity or health checks and compare appliance file integrity, configuration, and running processes against a known-good baseline.

Typical attack path

1. Identify an internet-accessible Ivanti Connect Secure or Ivanti Policy Secure administrative portal.
2. Obtain valid administrative or otherwise sufficient authenticated access through stolen credentials, phishing, password reuse, or a prior foothold.
3. Confirm the appliance version is older than the fixed release line.
4. Submit crafted input to the vulnerable administrative portal functionality.
5. Achieve command execution on the appliance in the context of the affected service.
6. Establish persistence, collect credentials or session data, and review appliance configuration.
7. Use the compromised appliance as a trusted pivot point into internal networks or to alter access policy.
8. Attempt to delete or tamper with logs to reduce forensic visibility.

How to detect it

Review Ivanti appliance administrative, authentication, system, web, and audit logs for evidence of exploitation before and after remediation. Focus on successful and failed administrative logins from unusual source IPs, new or rarely used administrator accounts, authentication outside normal hours, abrupt role or policy changes, and suspicious configuration exports. Look for portal requests that contain unusually long, encoded, shell-like, or metacharacter-heavy parameters around the time of administrative activity. Examine system logs for unexpected child processes spawned by web or admin portal services, command execution, file creation in web-accessible or temporary directories, cron or scheduled task changes, and outbound connections from the appliance to unfamiliar external hosts. If logs show gaps, truncation, service restarts, or clearing events after suspicious logins, treat that as potential anti-forensic behavior. Where available, use vendor integrity checking and compare the appliance against a known-good baseline. Because exploitation requires authentication, correlate appliance activity with identity-provider logs, MFA prompts, VPN admin logins, password resets, and impossible-travel events.

• Ivanti Connect Secure version earlier than 22.7R2.1
• Ivanti Connect Secure version earlier than 9.1R18.9
• Ivanti Policy Secure version earlier than 22.7R1.1
• admin portal login from unusual source IP
• new administrator account created
• administrator role modified
• MFA disabled
• configuration exported
• log cleared
• audit log cleared
• unexpected outbound connection from appliance
• /tmp/
• /var/tmp/
• /home/bin/
• /etc/cron
• crontab
• sh -c
• bash -c
• curl
• wget
• nc
• netcat
• python -c
• perl -e

What your security team should do

• Treat this as a high-priority perimeter-device vulnerability because exploit code is reported as weaponized and EPSS indicates elevated exploitation likelihood.
• Upgrade Ivanti Connect Secure to 22.7R2.1 or 9.1R18.9 or later, and Ivanti Policy Secure to 22.7R1.1 or later.
• Immediately restrict administrative portal access to trusted management networks and require multifactor authentication for all administrative users.
• Audit administrative accounts for unexpected users, privilege changes, disabled MFA, stale accounts, and suspicious login patterns.
• Rotate passwords, API credentials, local administrative credentials, and any secrets stored on or managed by the appliance if compromise is suspected.
• Collect and preserve appliance logs before rebooting, rebuilding, or making major changes to support forensic review.
• Hunt for post-exploitation activity such as unusual shell commands, unexpected file writes, new scheduled jobs, new administrative accounts, abnormal outbound connections, and log deletion.
• If exploitation is suspected, isolate the appliance from untrusted networks, engage incident response, rebuild from trusted media or vendor guidance, and re-enroll credentials rather than only patching in place.