CVE-2024-7593

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Ivanti — Virtual Traffic Manager

Added to KEV catalog: 24 September 2024
Federal remediation due date: 15 October 2024
Weakness classification (CWE): CWE-287, CWE-303

CISA Description

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 ; https://nvd.nist.gov/vuln/detail/CVE-2024-7593

View on NVD View on MITRE CVE View full CISA catalog

More Ivanti Vulnerabilities

CVE-2026-10520

Ivanti Sentry OS Command Injection Vulnerability

CVE-2026-6973

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

CVE-2026-1340

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

CVE-2026-1603

Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

CVE-2026-1281

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services