CVE-2024-7593

Published Aug 13, 2024 CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed

Description

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ivanti

vTM

affected

Version	Status	Constraints
`22.7R2`	unaffected	—
`22.2R1`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:ivanti:virtual_traffic_manager:22.2:::::::*
	cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:-::::::
	cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:r2::::::
	cpe:2.3:a:ivanti:virtual_traffic_manager:22.5:r1::::::
	cpe:2.3:a:ivanti:virtual_traffic_manager:22.6:r1::::::
	cpe:2.3:a:ivanti:virtual_traffic_manager:22.7:r1::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Sept. 24, 2024.

Exploit prediction score: 100.0% (99.999% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593

History

May 14, 2026 7:45 PM Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:ivanti:virtual_traffic_management:22.2:::::::* cpe:2.3:a:ivanti:virtual_traffic_management:22.3:-:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.3:r2:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.5:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.6:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.7:r1::::::	cpe:2.3:a:ivanti:virtual_traffic_manager:22.2:::::::* cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:-:::::: cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:r2:::::: cpe:2.3:a:ivanti:virtual_traffic_manager:22.5:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_manager:22.6:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_manager:22.7:r1::::::
Vendors & Products	Ivanti virtual Traffic Management

Oct 21, 2025 11:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593

Oct 21, 2025 8:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593

Oct 21, 2025 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.94399}`	epss `{'score': 0.94421}`

Sep 24, 2024 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	kev `{'dateAdded': '2024-09-24'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 6, 2024 10:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ivanti virtual Traffic Management
CPEs		cpe:2.3:a:ivanti:virtual_traffic_management:22.2:::::::* cpe:2.3:a:ivanti:virtual_traffic_management:22.3:-:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.3:r2:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.5:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.6:r1:::::: cpe:2.3:a:ivanti:virtual_traffic_management:22.7:r1::::::
Vendors & Products		Ivanti virtual Traffic Management

Aug 15, 2024 4:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Ivanti Ivanti virtual Traffic Manager
CPEs		cpe:2.3:a:ivanti:virtual_traffic_manager::::::::
Vendors & Products		Ivanti Ivanti virtual Traffic Manager
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 13, 2024 6:30 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Weaknesses		CWE-287 CWE-303
References		https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`