CVE-2024-9420: Ivanti Connect Secure RCE Vulnerability

CVE-2024-9420 Overview

CVE-2024-9420 is a use-after-free vulnerability [CWE-416] affecting Ivanti Connect Secure and Ivanti Policy Secure appliances. The flaw allows a remote authenticated attacker to trigger memory corruption and achieve remote code execution on the affected gateway. Ivanti Connect Secure versions prior to 22.7R2.3 and 9.1R18.9 are affected, along with Ivanti Policy Secure versions prior to 22.7R1.2. Because these products terminate VPN and network access sessions for enterprise perimeters, successful exploitation places attackers in a position to pivot into internal networks.

Critical Impact
An authenticated attacker can execute arbitrary code on the appliance, compromising the integrity, confidentiality, and availability of the VPN gateway and any resources reachable through it.

Affected Products

Ivanti Connect Secure versions prior to 22.7R2.3
Ivanti Connect Secure versions prior to 9.1R18.9
Ivanti Policy Secure versions prior to 22.7R1.2

Discovery Timeline

2024-11-12 - CVE-2024-9420 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9420

Vulnerability Analysis

CVE-2024-9420 is classified as a use-after-free condition [CWE-416] in the Ivanti Connect Secure and Ivanti Policy Secure code base. The defect allows a remote authenticated attacker to reference memory after it has been released, corrupting object state within the running process. Attackers who control the freed allocation can steer execution flow toward attacker-supplied data. The vulnerability requires low privileges and no user interaction, and it affects confidentiality, integrity, and availability equally.

Root Cause

The root cause is improper memory management in which an object is freed while other code paths retain references to it. When those references are subsequently dereferenced, the process operates on stale memory. Attackers exploit this pattern by racing or timing allocations so that attacker-controlled data occupies the freed region before the dangling reference is used. This lets them override function pointers, virtual tables, or object metadata.

Attack Vector

The vulnerability is exploitable over the network against the appliance's authenticated interfaces. An attacker must possess valid credentials, which lowers the barrier compared to unauthenticated bugs but does not preclude exploitation through phishing, credential reuse, or chaining with credential-disclosure flaws. Successful exploitation yields code execution in the context of the vulnerable process on the gateway.

No public proof-of-concept code is available for CVE-2024-9420. Refer to the Ivanti Security Advisory for Multiple CVEs for vendor-specific technical detail.

Detection Methods for CVE-2024-9420

Indicators of Compromise

Unexpected process crashes or restarts of core services on the Ivanti gateway, which may indicate failed exploitation attempts against the use-after-free condition.
Authenticated sessions originating from unusual geolocations or IP ranges immediately preceding gateway instability.
New or modified files in appliance-writable directories following authenticated administrative or user activity.
Outbound connections from the appliance to unexpected external hosts, consistent with post-exploitation command-and-control.

Detection Strategies

Enable and forward Ivanti Connect Secure and Policy Secure system logs, authentication logs, and audit trails to a centralized SIEM for correlation.
Baseline normal authenticated session behavior and alert on anomalous request patterns, repeated errors, or elevated crash rates.
Monitor for known post-compromise techniques on the appliance, including web shell deployment, credential harvesting, and configuration tampering.

Monitoring Recommendations

Regularly run Ivanti's Integrity Checker Tool (ICT) on affected appliances and investigate any deviation from expected results.
Alert on privileged administrative changes to VPN configuration, authentication realms, or role mappings performed outside change windows.
Correlate VPN authentication events with downstream internal network access to detect lateral movement following gateway compromise.

How to Mitigate CVE-2024-9420

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.3 or 9.1R18.9, and Ivanti Policy Secure to 22.7R1.2 or later.
Rotate credentials for any accounts able to authenticate to the gateway, particularly administrative accounts.
Review authentication logs since the appliance was last patched to identify suspicious sessions.
Run the Ivanti Integrity Checker Tool and treat any anomalies as a potential compromise.

Patch Information

Ivanti has released fixed builds addressing CVE-2024-9420. Apply Ivanti Connect Secure 22.7R2.3 or 9.1R18.9, and Ivanti Policy Secure 22.7R1.2. Consult the Ivanti Security Advisory for Multiple CVEs for the complete list of fixed versions and upgrade guidance.

Workarounds

No vendor-provided workaround eliminates the vulnerability without patching; upgrading to a fixed build is the required remediation.
Restrict administrative and user access to the gateway to trusted networks and enforce multi-factor authentication to reduce the pool of attackers who can meet the authenticated precondition.
Segment the Ivanti appliance from sensitive internal assets so that a compromise of the gateway does not immediately grant broad lateral movement.

bash

# Configuration example: verify appliance version before and after upgrade
# From the Ivanti administrative CLI
show version

# Expected output after remediation (one of):
#   Ivanti Connect Secure 22.7R2.3
#   Ivanti Connect Secure 9.1R18.9
#   Ivanti Policy Secure 22.7R1.2