CVE-2024-8963 - Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality

CRITICAL KEV

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality

Published Sep 19, 2024 ·Due Oct 10, 2024

9.4

CRITICAL

CVSS 3.1

EPSS 98.61%

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

Vendor Ivanti Product Endpoint Manager Cloud Services Appliance Default
unknown
Affected
- ≥ 0, < 4.6patch519

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Ivanti	Endpoint Manager Cloud Services Appliance	unknown	Affected ≥ 0, < 4.6patch519

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49510		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963		Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963		government-resourceUS Government Resource

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ivanti

Published Sep 19, 2024

Updated Oct 21, 2025

Reserved Sep 17, 2024

CISA Vulnrichment

Updated Sep 21, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner ivanti

Published Sep 19, 2024

Updated Oct 21, 2025

Exploited since Sep 19, 2024

GitHub

No data