A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Details
EPSS Score
ⓘ
99.11%
99.9th percentile
Confidence
100%
Published
Dec 8, 2021
Last Modified
Aug 4, 2026
CISA KEV
Date Added
Mar 25, 2024
Patch Due
Apr 15, 2024
Used in ransomware campaigns
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.