Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

cisa required action As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

1. 2024-09-19 Added to CISA KEV
2. 2024-09-19 Published
3. 2024-09-21 CISA SSVC: exploitation active
4. 2024-10-10 CISA patch deadline

Added

2 y ago (2024-09-19)

Patch by

2024-10-10 (2 y ago)

Ransomware

Not known

Required action

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Vendor, product

Ivanti, Cloud Services Appliance (CSA)

CISA name

Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

2 y ago (2024-09-21)

98.61% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Nuclei template Ivanti Cloud Services Appliance - Path Traversal nuclei detection template

• Ivanti CSA (Cloud Services Appliance)
• ivanti endpoint_manager_cloud_services_appliance

Weakness

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory

• forums.ivanti.com /s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963

  government-resource, us-government-resource

• CVE List CVE-2024-8963
• NVD CVE-2024-8963

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.