{"id":"CVE-2024-10644","published":"2025-02-11T15:20:46Z","modified":"2026-02-26T19:09:17Z","title":"Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3…","vendor":"Ivanti","product":"Connect Secure","tier":"tail","description":{"text":"Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02819,"percentile":0.86517,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs","tags":[]}],"priority":{"score":23.7,"factors":[{"name":"EPSS percentile","points":17.3},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"ivanti","affectedVersions":[{"vendor":"Ivanti","product":"Connect Secure","versions":["all versions"]},{"vendor":"Ivanti","product":"Policy Secure","versions":["all versions"]}],"euvd":{"id":"EUVD-2025-4985","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-ivanti-connect-secure-cwe-94"}}