CVE Database · CVE-2024-8963
CVSS v3.1
9.4
EPSS
98.41%
Published
Sep 19, 2024
Modified
Oct 24, 2025
CISA Known Exploited Vulnerability
Added: 2024-09-19 · Due: 2024-10-10
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Public PoC / Exploit (3)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LWeaknesses (CWE)
Affected Products (3)
References (2)