CVE-2024-21888

CVE-2024-21888 is a software vulnerability identified in Ivanti Connect Secure and Ivanti Policy Secure's Web component. This flaw, which presents as a privilege escalation vulnerability, was discovered during the rollout of updates for other vulnerabilities. Despite its potential severity, there have been no observed instances of this vulnerability being exploited in the wild at the time of disclosure. This vulnerability was disclosed alongside two others, CVE-2024-21893 and CVE-2024-21887, both of which had already seen active exploitation. CVE-2024-21893, a server-side request forgery flaw, has been used in targeted zero-day attacks. The news about these vulnerabilities followed closely on the heels of an Ivanti update that included fixes for these bugs, indicating a high level of threat activity associated with Ivanti products. In response to these findings, Ivanti began releasing patches for all the mentioned vulnerabilities, including CVE-2024-21888. Additionally, they provided a second mitigation aimed at enhancing resilience against attacks that chain CVE-2024-21893 with CVE-2024-21887 to compromise Ivanti devices. Organizations using Ivanti products are advised to apply these patches and mitigations promptly to reduce their risk exposure.