{"id":"CVE-2024-8190","published":"2024-09-10T21:15:14Z","modified":"2026-06-17T08:22:05Z","title":"Ivanti Cloud Services Appliance OS Command Injection Vulnerability","vendor":"Ivanti","product":"Cloud Services Appliance","tier":"core","eol":null,"description":{"text":"An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"The Ivanti Cloud Services Appliance contains an OS command injection flaw, classified as improper neutralization of special elements used in an OS command, affecting versions 4.6 Patch 518 and earlier. A remote attacker who already holds administrator-level privileges on the appliance can exploit it to achieve remote code execution, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:47Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.88535,"percentile":0.99773,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2024-09-13","dueDate":"2024-10-04","ransomware":false,"requiredAction":"As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.","notes":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190; https://nvd.nist.gov/vuln/detail/CVE-2024-8190","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-09-13","exploitedFirstSeen":"2024-09-13","ransomware":false,"evidence":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190","date":"2024-09-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-09-13"},{"url":"https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa","date":"2024-10-11"},{"url":"https://harfanglab.io/insidethelab/insights-ivanti-csa-exploitation/","date":"2024-12-12"},{"url":"https://www.cisa.gov/sites/default/files/2025-01/aa25-022a-threat-actors-chained-vulnerabilities-in-ivanti-cloud-service-applications.pdf","date":"2025-01-22"},{"url":"https://www.fortiguard.com/outbreak-alert/ivanti-csa-zero-day-attack","date":"2025-01-24"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-004.pdf","date":"2025-03-11"},{"url":"https://www.zscaler.com/resources/industry-reports/threatlabz-vpn-risk-report-2025.pdf","date":"2025-04-10"},{"url":"https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/","date":"2025-06-09"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance","tags":["US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires valid admin-level credentials to reach vulnerable code","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"The attacker must have admin level privileges to exploit this vulnerability","start":179,"end":254}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: OS command injection yields command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a remote authenticated attacker to obtain remote code execution","start":107,"end":177}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-49004","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49004","exploited":true,"exploitedSince":"2024-09-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-09-16","earliestUrl":"https://github.com/horizon3ai/CVE-2024-8190","repos":[{"name":"horizon3ai/CVE-2024-8190","url":"https://github.com/horizon3ai/CVE-2024-8190","stars":17,"created":"2024-09-16"},{"name":"flyingllama87/CVE-2024-8190-unauth","url":"https://github.com/flyingllama87/CVE-2024-8190-unauth","stars":2,"created":"2025-03-04"}]},"first":{"date":"2024-09-16","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-8190"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-09-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8190","provenance":"source"},{"date":"2024-09-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190","provenance":"source"},{"date":"2024-09-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-09-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49004","provenance":"source"},{"date":"2024-09-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-8190","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":3},"priority":{"score":65.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 779 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}