CVE-2024-8963: Ivanti Cloud Services Appliance path traversal, unauthenticated and exploited
The short version: CVE-2024-8963 is a path-traversal flaw in the Ivanti Cloud Services Appliance (CSA) that lets an unauthenticated attacker reach restricted administrative functionality. On its own it's an access-control failure; chained with a companion CSA command-injection bug it was used for remote code execution, and it's in CISA's KEV catalog. If you run an affected CSA, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated access to admin functionality on an internet-facing gateway, chained to RCE |
| CVSS v3.1 (NVD) | 9.4 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| EPSS | ~98.6% · 99.92nd percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-10-10 |
| Known exploited? | Yes — listed in CISA KEV; used chained with a companion CSA vulnerability |
| Vulnerability type | CWE-22 path traversal → unauthenticated access to restricted functionality (enables RCE chain) |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ivanti CSA before 4.6 Patch 519 |
| Fixed in | CSA 4.6 Patch 519 (upgrade to CSA 5.0, which is the supported line) |
What you need to know
CVE-2024-8963 lets an unauthenticated request traverse outside the intended path and reach restricted administrative functionality on the CSA. That access is the opening: paired with a companion command-injection weakness in the same appliance, attackers turned it into remote code execution.
Why it belongs at the top of the queue:
- It's pre-authentication and internet-facing. The CSA is designed to be reachable, so the flaw is directly exposed.
- It's a chain enabler. The path traversal unlocks admin functionality that a second bug then abuses for code execution — the whole point of prioritizing it.
- It's confirmed exploited. CISA added it to KEV, and Ivanti reported active exploitation.
How serious we see it
High — in practice and close to it on paper.
Unauthenticated access to administrative functionality on an internet-facing management appliance is dangerous in itself, and here it was the first link in a working remote-code-execution chain, exploited in the wild. We rate it by that reality. The bounded, reassuring part: it affects a specific CSA line, the fix is published, and exposure is quick to determine. Because it was exploited before many organizations patched, treat an exposed, unpatched CSA as potentially compromised.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Apply CSA 4.6 Patch 519; better still, move to the supported CSA 5.0 line.
- Hunt for compromise. Follow Ivanti's guidance to check for signs of exploitation and web shells, given the pre-patch activity.
- If compromised, respond fully. Rebuild the appliance and rotate all credentials, keys, and certificates it held.
- Harden exposure. Restrict who can reach the CSA; keep management interfaces off the public internet where possible.
- Confirm your exposure first. Verify whether you run an affected CSA build.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti CSA gateways, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view means an exposed CSA is already mapped when the next chain drops — so you go straight to patch-and-verify instead of hunting for what you own.