Command Injection RCE in Ivanti Cloud Services Application Admin Web Console

Successful exploitation results in remote code execution on the Ivanti CSA system. Because exploitation requires administrator-level access to the web console, an attacker who can reach the vulnerable interface and authenticate as an administrator can execute arbitrary commands, potentially leading to full compromise of the CSA host, unauthorized system changes, deployment of additional payloads, access to sensitive data handled by the appliance or application, and use of the system as a pivot point for further intrusion activity.

If immediate patching is not possible, reduce exposure of the CSA administrator web console to only trusted management networks, restrict remote access to administrative interfaces, minimize the number of accounts with administrator privileges, and monitor administrative activity for signs of misuse. Because exploitation requires authenticated administrator access, enforcing strong access controls and limiting who can reach and use the admin console can reduce risk until the product is upgraded. These measures are compensating controls and do not replace upgrading to a fixed version.

Upgrade Ivanti Cloud Services Application to version 5.0.3 or later. Versions prior to 5.0.3 are affected. Ivanti recommended immediate installation of the fixed supported release to remove the vulnerable code path in the administrator web console.