CVE-2024-7593

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-303

Affected software

Vendor	Product	Versions
Ivanti	vTM	—
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2
ivanti	virtual_traffic_manager	>= 22.7r1, < 22.7r2; >= 22.2, < 22.2r1; >= 22.3, < 22.3r3; >= 22.3r2, < 22.3r3; >= 22.6r1, < 22.6r2; >= 22.5r1, < 22.5r2

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593Mitigation, Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593US Government Resource

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 24, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-75948.8Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user CVE-2024-75956.5GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary CVE-2024-75966.5Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof CVE-2024-75983.1A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network pol CVE-2024-75995.4The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all version CVE-2024-76008.1Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to del CVE-2024-76018.1Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows CVE-2024-76026.5Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disc CVE-2024-76038.1Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers t CVE-2024-76047.8Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to by CVE-2024-76054.3The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' fun CVE-2024-76065.4The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versio