Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2024-7593

🗓️ 13 Aug 2024 18:17:47Reported by ivantiType 
cve
 cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 190 Views🌐 WEB

Incorrect authentication implementation in Ivanti vT

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		Exploit for Incorrect Implementation of Authentication Algorithm in Ivanti Virtual_Traffic_Management
24 Sep 202422:24
–githubexploit
githubexploit
GithubExploit		Exploit for Incorrect Implementation of Authentication Algorithm in Ivanti Virtual_Traffic_Management
12 Oct 202402:17
–githubexploit
attackerkb
attackerkb		CVE-2024-7593
13 Aug 202400:00
–attackerkb
bdu_fstec
BDU FSTEC		The vulnerability of the Ivanti Virtual Traffic Manager (vTM)’s traffic management and load balancing functionality lies in its flawed authentication algorithm implementation, which allows attackers to circumvent existing security restrictions.
21 Aug 202400:00
–bdu_fstec
circl
Circl		CVE-2024-7593
13 Aug 202419:39
–circl
cisa_kev
CISA KEV Catalog		Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
24 Sep 202400:00
–cisa_kev
cisa
CISA		 Ivanti Releases Security Updates for Avalanche, Neurons for ITSM, and Virtual Traffic Manager
13 Aug 202412:00
–cisa
cisa
CISA		 CISA Adds One Known Exploited Vulnerability to Catalog
24 Sep 202412:00
–cisa
cnnvd
CNNVD		Ivanti Virtual Traffic Manager 安全漏洞
13 Aug 202400:00
–cnnvd
cvelist
Cvelist		CVE-2024-7593
13 Aug 202418:17
–cvelist
Rows per page
[
  {
    "defaultStatus": "affected",
    "product": "vTM",
    "vendor": "Ivanti",
    "versions": [
      {
        "status": "unaffected",
        "version": "22.7R2",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "22.2R1",
        "versionType": "custom"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
_form_submittedquery param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
create_userquery param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
groupquery param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
newusernamequery param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
password1query param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
password2query param/apps/zxtm/wizard.fcgi?error=1&section=Access+Management%3ALocalUsersCreate a new admin user through the wizard.fcgi endpoint to bypass admin authentication.CWE-287, CWE-303
_form_submittedrequest body/apps/zxtm/login.cgiPost admin credentials to login.cgi to verify or obtain an admin session after user creation.CWE-287, CWE-303
form_usernamerequest body/apps/zxtm/login.cgiPost admin credentials to login.cgi to verify or obtain an admin session after user creation.CWE-287, CWE-303
form_passwordrequest body/apps/zxtm/login.cgiPost admin credentials to login.cgi to verify or obtain an admin session after user creation.CWE-287, CWE-303
form_submitrequest body/apps/zxtm/login.cgiPost admin credentials to login.cgi to verify or obtain an admin session after user creation.CWE-287, CWE-303

shah_sheikh

Experts warn of exploit attempt for Ivanti vTM bug: Researchers at the Shadowserver Foundation observed an exploit attempt based on the public PoC for Ivanti vTM bug CVE-2024-7593. Researchers at the Shadowserver Foundation observed an exploit attempt… https://t.co/T7k0P6AaQX

Unit42_Intel

Time to patch/mitigate/monitor for exploitation of CVE-2024-7593 (authentication bypass in Ivanti Virtual Traffic Manager). POC available, but no known exploitation in the wild so far. Patches available now for some versions, more next week. See advisory: https://t.co/SyNCZBhWsT

rxerium

Ivanti vTM (CVE-2024-7593) detection method: Scan your infrastructure to ensure you are not vulnerable to this 0day:

DarkWebInformer

PoC for CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass

CveFindCom

[CVE-2024-7593: CRITICAL] Ivanti vTM versions other than 22.2R1 or 22.7R2 are vulnerable to a cyber attack, allowing unauthorized access to the admin panel due to authentication algorithm flaw.#cybersecurity,#vulnerability https://t.co/pRUpslYNbk

the_yellow_fall

CVE-2024-7593 (CVSS 9.8): Critical Ivanti vTM Flaw Now Weaponized, #PoC Exploit Available Security researchers have published a #Metasploit module that automates the exploitation of CVE-2024-7593

Komodosec

#Vulnerability #CVE20247593 CVE-2024-7593 (CVSS 9.8): Critical Ivanti vTM Flaw Now Weaponized, PoC Exploit Available

jsmidrkal

Here goes Ivanti again. CVE-2024-7593 on Virtual Traffic Manager (vTM), allowing remote unauthenticated attackers to bypass authentication and create admin accounts. CVSSv2: 10, CVSSv3: 9.8 https://t.co/AfT0mM9pze https://t.co/9BuIIxhFD6

transilienceai

Actively exploited CVE : CVE-2024-7593

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 08:20Current
8.2High risk
Vulners AI Score8.2
CVSS 3.19.8
EPSS0.99999
SSVC
CWE-287CWE-303In Wild
ivanti vtmauthentication bypasscve-2024-7593remote attacker
190