CVE-2024-10644: RCE in Ivanti Connect Secure

The impact of CVE-2024-10644 is severe. Successful exploitation allows a remote, authenticated administrator to execute arbitrary code on the Ivanti Connect Secure server. This can lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of persistent malware. Attackers could leverage this access to pivot to other systems within the network, leading to widespread lateral movement and a significant blast radius. Given the nature of Ivanti Connect Secure as a gateway for remote access, a successful attack could expose sensitive internal resources and intellectual property. The requirement for admin privileges, while a barrier, does not negate the severity, as attackers may attempt to compromise accounts with these privileges.

1. Reserved2024-10-31
2. Published2025-02-11
3. Modified2026-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-10644 is to immediately upgrade Ivanti Connect Secure to version 22.7R2.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While no specific WAF rules are publicly available, restricting access to potentially vulnerable endpoints and implementing strict authentication policies can help reduce the attack surface. Monitor system logs for suspicious activity, particularly attempts to execute commands or access sensitive files. After upgrading, verify the fix by attempting to reproduce the vulnerability using known exploitation techniques (if available) or by reviewing Ivanti's security advisory for confirmation.