The vulnerability of Ivanti Connect Secure (previously known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons for Zero Trust Access (nZTA) – tools for authentication and access control – stems from incorrect restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information.

🗓️ 14 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Ivanti Connect Secure, Policy Secure, and Neurons Zero Trust Access have an XML link restriction flaw enabling unauthorized access.

Reporter	Title	Published	Views	Family All 29
GithubExploit	Exploit for Improper Restriction of XML External Entity Reference in Ivanti Connect_Secure	9 Feb 202414:31	–	githubexploit
ICS	Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways	29 Feb 202412:00	–	ics
Akamai Blog	Scanning Activity for CVE-2024-22024 (XXE) Vulnerability in Ivanti	14 Feb 202406:00	–	akamaiblog
ATTACKERKB	CVE-2024-22024	13 Feb 202400:00	–	attackerkb
Circl	CVE-2024-22024	10 Jan 202420:21	–	circl
CISA	Updated: New Software Updates and Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways	15 Feb 202412:00	–	cisa
CNNVD	Ivanti Connect Secure and Ivanti Policy Secure Code Issue Vulnerabilities	13 Feb 202400:00	–	cnnvd
CVE	CVE-2024-22024	13 Feb 202404:07	–	cve
Cvelist	CVE-2024-22024	13 Feb 202404:07	–	cvelist
hivepro	Ivanti Addresses Yet Another VPN Flaw Within a Month	12 Feb 202411:47	–	hivepro

Vulners

Node

ivanti connect_secureMatch9.1r14.4

OR

ivanti connect_secureMatch9.1r17.2

OR

ivanti connect_secureMatch9.1r18.3

OR

ivanti connect_secureMatch22.4r2.2

OR

ivanti connect_secureMatch22.5r1.1

OR

ivanti policy_secureMatch22.5r1.1

OR

ivanti ivanti_neurons_for_zero_trust_access_(nzta)Match22.6r1.3

Source	Link
help	www.help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-zta/gsg/pzta_gsg_oview.htm
forums	www.forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure
xakep	www.xakep.ru/2024/02/09/ivanti-cve-2024-22024/
forums	www.forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways
gist	www.gist.github.com/Hamid-K/f4288dae3a1f2dea8905b1cf16d59c1b
web	www.web.nvd.nist.gov/view/vuln/detail

17 Oct 2025 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 27.5

CVSS 38.3

EPSS0.94721

Ivanti Connect Secure Policy Secure Neurons Zero Trust XML Link Restriction Unauthorized Access