CVE-2024-8963

What it actually does

CVE-2024-8963 is a path traversal flaw in Ivanti Cloud Services Appliance (CSA) before version 4.6 Patch 519. A remote, unauthenticated attacker can craft requests that bypass normal path and access-control handling to reach restricted CSA functionality that should require authentication or administrative access. By itself, this can expose protected application functions; when chained with other CSA vulnerabilities, especially authenticated command-injection flaws, it can enable unauthenticated remote code execution on the appliance.

Why it matters to the business

Successful exploitation can give attackers unauthorized access to a security-relevant edge appliance, potentially allowing appliance takeover, credential theft, persistence, lateral movement, and disruption of remote access or device-management workflows. This vulnerability is in CISA KEV, has very high EPSS probability, and is actively exploited in the wild, so internet-exposed Ivanti CSA systems should be treated as high-priority remediation targets. CISA required remediation for federal agencies by 2024-10-10, indicating operational urgency even for non-federal organizations.

How an attack unfolds

An attacker first identifies an exposed Ivanti CSA instance and determines whether it is running a vulnerable release before 4.6 Patch 519. They then send a crafted HTTP request containing path traversal or malformed routing sequences that cause the CSA web application to resolve the request to restricted functionality without requiring authentication. In real-world activity, attackers have chained this access-control bypass with other Ivanti CSA vulnerabilities to reach administrative endpoints and execute commands. After gaining execution or privileged application access, the attacker may deploy web shells, create or modify accounts, collect configuration and credential material, establish persistence, and use the appliance as a pivot point into connected internal services.

How to fix it

Upgrade Ivanti CSA to 4.6 Patch 519 or later where supported. Because CSA 4.6 is an older branch, organizations should also follow Ivanti guidance on upgrading to a supported CSA 5.x release where applicable. If immediate patching is not possible, restrict access to the CSA interface using VPN, firewall allowlists, or management-network-only exposure; block direct internet access; and monitor aggressively for exploitation attempts. Treat any vulnerable internet-exposed appliance as potentially compromised and perform incident-response review before returning it to service.

How to confirm the fix worked

Confirm the installed Ivanti CSA version and patch level from the appliance administration interface or vendor-supported command-line/package inventory and verify it is 4.6 Patch 519 or later, or a supported fixed 5.x release. Externally validate that CSA administrative and restricted application paths are not reachable without authentication. Review reverse proxy, WAF, and appliance web logs for traversal sequences, encoded path manipulation, and unauthenticated requests to restricted endpoints. If the appliance was exposed while vulnerable, validate integrity by checking for unexpected files in web-accessible directories, unknown users, modified startup or scheduled-task entries, unusual outbound connections, and evidence of command execution.

Typical attack path

1. Scan the internet or target ranges for exposed Ivanti CSA web interfaces.
2. Fingerprint the CSA version or infer vulnerability based on response behavior.
3. Send crafted unauthenticated HTTP requests using traversal or malformed path routing to access restricted CSA functionality.
4. Chain the access gained through the traversal flaw with another CSA vulnerability to execute commands or perform administrative actions.
5. Deploy persistence such as web shells, scheduled tasks, new accounts, or modified appliance configuration.
6. Collect credentials, session material, configuration files, and network information from the appliance.
7. Use the compromised appliance for lateral movement, further exploitation, or long-term remote access.

How to detect it

Review Ivanti CSA appliance web logs, reverse proxy logs, WAF logs, and network telemetry for unauthenticated requests containing path traversal sequences, encoded traversal characters, or attempts to access restricted CSA paths. Pay particular attention to requests involving malformed PHP routing, encoded question marks, dot-dot path segments, and administrative endpoints reached without a valid session. Because this flaw has been actively chained with other CSA vulnerabilities, also review operating system logs, process execution telemetry, file integrity monitoring, and appliance audit logs for signs of command execution, unexpected file writes under web directories, new or modified users, suspicious cron or scheduled tasks, and unusual outbound connections. Look for web shell behavior such as POST requests to newly created PHP files, small PHP files containing command-execution functions, and repeated requests from the same source immediately followed by system commands or outbound callbacks.

• ../
• ..%2f
• %2e%2e%2f
• ..%5c
• %2e%2e%5c
• /gsb/DateTimeTab.php
• DateTimeTab.php
• /client/index.php%3F.php/gsb/DateTimeTab.php
• index.php%3F.php
• /client/index.php?.php/gsb/DateTimeTab.php
• /opt/landesk/broker/webroot/client/
• /opt/landesk/broker/webroot/
• /opt/landesk/
• eval(
• shell_exec(
• system(
• passthru(
• base64_decode(
• cmd=
• whoami
• id;
• uname -a
• /bin/sh
• /bin/bash
• curl http
• wget http
• nc -e
• chmod +x

What your security team should do

• Immediately identify all Ivanti CSA appliances, especially internet-facing instances, and verify version and patch level.
• Patch or upgrade affected systems to Ivanti CSA 4.6 Patch 519 or a supported fixed release; prioritize internet-facing systems first.
• If patching cannot be completed immediately, remove CSA from direct internet exposure and restrict access to trusted administrative networks only.
• Assume exposed vulnerable appliances may have been targeted; perform compromise assessment rather than relying only on patch verification.
• Search historical web, WAF, reverse proxy, and appliance logs for traversal patterns and unauthenticated access to restricted CSA endpoints.
• Hunt for chained exploitation involving CSA command-injection endpoints, unexpected shell commands, web shells, new accounts, and unusual outbound network activity.
• Rotate credentials, API tokens, and secrets stored on or accessible from the appliance if exploitation is suspected.
• Apply vendor-provided hardening and monitoring guidance, and keep CSA on a supported release branch.