A critical security vulnerability, CVE-2024-8963, has been discovered in Ivanti’s Cloud Services Appliance (CSA) version 4.6 . The flaw, which has a high CVSS score of 9.4, was addressed incidentally in the patch released on September 10, 2024 (Patch 519). However, it remains a significant risk for organisations that have not yet applied this update.

Understanding CVE-2024-8963

This vulnerability allows remote unauthenticated attackers to exploit the system by accessing restricted functionality. When combined with CVE-2024-8190, it can lead to a dangerous escalation, enabling attackers to bypass admin authentication and execute arbitrary commands on the affected system. This opens the door to potentially serious security breaches, including unauthorised system control, data exfiltration, and further network compromise.

The root cause of this vulnerability lies in a CWE-22 issue, commonly known as “Improper Limitation of a Pathname to a Restricted Directory,” also referred to as a Path Traversal vulnerability. Attackers exploiting this flaw can manipulate file paths to gain unauthorised access to sensitive files or directories.

Products Affected

• Ivanti CSA (Cloud Services Appliance): Version 4.6 (all versions prior to Patch 519)

Impact and Exploitation

Successful exploitation of CVE-2024-8963 could allow an attacker to take advantage of restricted system functions, leading to the execution of arbitrary commands. While no known ransomware operators have been reported to use this vulnerability, it has been included in the CISA Known Exploited Vulnerability (KEV) catalog, indicating its serious nature and potential for exploitation in the wild.

EPSS and Risk Assessment

CVE-2024-8963 has an Exploit Prediction Scoring System (EPSS) score of 0.979, indicating a high likelihood of exploitation. This makes timely remediation critical for any affected organisation.

Mitigation and Recommendations

The National Cyber Security Centre (NCSC) strongly recommends that affected organisations apply the Ivanti CSA 4.6 Patch 519 immediately to mitigate the risk of exploitation. For organisations unable to apply the patch, it is essential to review Ivanti’s security advisory and follow any additional mitigations that may be available.

Organisations should also assess their systems for any signs of compromise, as the vulnerability is now widely known and could be actively targeted by threat actors.

CVE-2024-8963 underscores the importance of prompt patch management and regular system updates, especially for critical infrastructure like the Ivanti Cloud Services Appliance. With its high CVSS score and inclusion in the CISA KEV catalog, this vulnerability represents a significant risk that requires immediate attention. Ensuring that all security patches are applied will help organisations protect their systems from potential exploitation and maintain the integrity of their IT infrastructure.

For tailored solutions to safeguard your business from cybersecurity threats, contact our team today .

Fill out the form below to get started, and let our experts help you enhance your cybersecurity posture. 👇