CVE-2024-8190

Ivanti Cloud Services Appliance allows authenticated admins to execute arbitrary OS commands via command injection in the admin console.

This vulnerability enables remote code execution for authenticated administrators, posing a severe risk to DIB organizations relying on Ivanti appliances for network management and security. The active exploitation status and command injection nature mean that compromised credentials could lead to full system compromise, violating NIST 800-171 and FedRAMP requirements for system integrity and access control. DIB orgs must immediately patch affected systems and audit all administrative access to prevent lateral movement.

Shame score — Active exploitation of a command injection vulnerability in a widely deployed network management appliance indicates a critical security oversight.