Hazard

Is CVE-2024-8963 being exploited?

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks.

Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

Ivanti · Cloud Services Appliance (CSA)

CVSS 9.4 EPSS 99% no public exploit indexed Fix deadline passed 10 October 2024

What it is

Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.

Why we say that

  • EPSS puts exploitation in the next 30 days at 99%
  • CISA's federal remediation deadline (2024-10-10) has passed
  • CVSS 9.4 critical
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →