CVE-2024-7593: Ivanti Virtual Traffic Manager authentication bypass, admin takeover
The short version: CVE-2024-7593 is an authentication-bypass flaw in Ivanti Virtual Traffic Manager (vTM), caused by an incorrectly implemented authentication algorithm. A remote, unauthenticated attacker can bypass the admin panel and create a rogue administrator account — full control of the load balancer. It scores 9.8, a public exploit exists, and it's in CISA's KEV catalog. If your vTM admin panel is reachable, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated admin takeover of a traffic-management appliance |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-10-15 |
| Known exploited? | Yes — listed in CISA KEV; public exploit available |
| Vulnerability type | CWE-287 / CWE-303 improper authentication → admin-panel bypass, rogue admin account |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ivanti vTM (versions other than 22.2R1 and 22.7R2) |
| Fixed in | 22.2R1 · 22.7R2 (fixes also provided for 22.3R3, 22.5R2, 22.6R2 — see advisory) |
What you need to know
CVE-2024-7593 is a flaw in the authentication algorithm behind the vTM administrative interface: it can be satisfied without valid credentials. An unauthenticated attacker abuses that to bypass the login and create a new administrator account, giving them lasting, privileged control of the appliance.
Why it belongs at the top of the queue:
- It's pre-authentication and yields admin. No credentials, no chain — straight to a rogue administrator.
- It's a traffic-management appliance. vTM sits in the path of application traffic; control of it means the ability to intercept, redirect, or disrupt what flows through.
- It's exploitable off the shelf. A public exploit exists and CISA has added it to KEV.
How serious we see it
High — in practice and on paper.
Unauthenticated admin takeover of an internet-reachable traffic appliance, with a public exploit and KEV listing, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific vTM builds, the fixes are published, and exposure is quick to determine. The immediate defensive win is also simple — the admin panel should not be exposed to the internet in the first place.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Upgrade to a fixed vTM build — 22.2R1 / 22.7R2 or the patched release for your line (22.3R3, 22.5R2, 22.6R2). See Ivanti's advisory for the exact mapping.
- Get the admin panel off the internet. Bind management to a trusted, internal interface — Ivanti's guidance is not to expose it publicly.
- Hunt for rogue accounts. Review the vTM administrator list for accounts you didn't create.
- If compromised, respond. Remove rogue admins, rotate credentials and keys, and review configuration changes.
- Confirm your exposure first. Verify whether any vTM admin interface is reachable and which version it runs.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti vTM interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view answers the first question — is our vTM admin panel exposed and affected? — before an attacker does, so you can go straight to patch-and-verify.