critical9.8Known exploited
CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-09-24. Federal due date: 2024-10-15.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | Virtual Traffic Manager | Versions 22.2, 22.3, 22.5, 22.6, 22.7 |