CVE-2024-21887

This vulnerability is like finding a “hidden shortcut” in a locked control panel: if someone has admin access, they may be able to type a specially crafted message that makes the device run commands chosen by the attacker. In everyday terms, it means the system could be tricked into doing things it normally should never do, such as executing attacker-specified actions.

This matters to you if you use or manage Ivanti Connect Secure (9.x, 22.x) or Ivanti Policy Secure (9.x, 22.x), including Ivanti ICS and Ivanti IPS. Because the bug requires an authenticated administrator, it primarily affects organizations where attackers (or insiders/compromised accounts) can reach admin access on these appliances.

Act immediately. This is marked RED because the flaw is in a security product, there is a known exploited-in-the-wild entry (CISA KEV) tied to ransomware activity, and public exploitation resources exist, which makes real-world abuse more likely and faster to perform. Even though press notes indicate no confirmed exploitation in the specific moment, the overall risk is extremely high given the information available.