CVE-2024-38656

score

<0.1

cvss

9.1

epss

1.7%

published

2024-11-13

kev added

—

first seen

2026-10-21

Ivanti Connect Secure before 22.7R2.2, 9.1R18.9, and Ivanti Policy Secure before 22.7R1.2 contain an argument injection caused by improper input handling in the argument processing component, letting a remote authenticated attacker with admin privileges execute arbitrary code, exploit requires admin privileges.