CVE-2024-47908

Severity

CRITICAL

CVSS

9.1

EPSS

0.22331

Risk score

44.22

CISA KEV

PoC

Published

2025-02-11

Modified

2026-02-26

First seen

2026-08-07

Aliases

EUVD-2025-4980, GHSA-JGRG-XX2Q-5XGC

Products

Ivanti:Cloud Services Application patch: 5.0.5

Sources

euvd EUVD-2025-4980

Description

OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-4980
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-47908-CVE-2024-11771