---
title: "Ivanti vTM CVE-2024-7593: Admin Auth Bypass, Exploited"
url: https://erroneo.us/security/briefs/ivanti-vtm-cve-2024-7593-admin-auth-bypass/
description: "Unauthenticated admin creation in Ivanti Virtual Traffic Manager, in KEV. Fixed in 22.2R1 to 22.7R2, now mostly unsupported. Move to 22.9 and audit admins."
type: security-brief
section: "Security Digest"
date_published: 2024-08-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-7593"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti vTM CVE-2024-7593: Admin Auth Bypass, Exploited

**Verdict: Check exposure.** Patched vTM is safe from this bug, but most of the fixed trains are now out of support; find any vTM still unpatched or with an internet-reachable admin interface, move it to 22.9, and check the audit log for exploit-created admins.

- **Who must act:** Anyone running Ivanti vTM 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1 or 22.7R1, and anyone whose vTM admin interface is reachable from untrusted networks.
- **Who can relax:** vTM deployments on 22.9, or on a fixed build with the admin server bound to a private management IP, once the audit log comes back clean.
- **Affected:** vTM 22.2 (before 22.2R1); vTM 22.3 and 22.3R2; vTM 22.5R1; vTM 22.6R1; vTM 22.7R1
- **Fixed:** 22.2R1 (released Mar 26, 2024); 22.7R2 (released May 20, 2024); 22.3R3, 22.5R2, 22.6R2 (released Aug 19, 2024); Only 22.9 LTS is still supported (end of support Jul 15, 2028)
- **CVEs:** CVE-2024-7593
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every vTM instance, including lab and cloud instances, and record its version.
2. Upgrade anything below 22.2R1, 22.3R3, 22.5R2, 22.6R2 or 22.7R2 now, then plan the move to 22.9 LTS.
3. Bind the admin server to the management interface IP (System > Security > Management IP Address and Admin Server Port > bindip) and allow only trusted IPs.
4. Search the audit log for exploit-created admins and compare the admin list with your records.
5. If you find a rogue admin, rebuild the instance and rotate admin passwords, certificates and backend credentials in its config.

### How to check if you are affected

- Search vTM audit logs for OPERATION=adduser entries where USER, GROUP, AUTH and IP are all !!ABSENT!!, which Ivanti says marks an account added by the exploit.
- Compare local administrator accounts with your records and treat any unknown admin as a compromise.
- Check whether the admin interface has been reachable from the internet since August 2024, for example with an external scan of vTM addresses.

## What happened

On August 12, 2024, Ivanti published an [advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593?language=en_US) for CVE-2024-7593 in Virtual Traffic Manager (vTM), its software load balancer. An incorrect implementation of an authentication algorithm lets a remote, unauthenticated attacker bypass the admin panel login and create an administrator account. Ivanti scores it CVSS 9.8 (CWE-287, CWE-303), and so does [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-7593). At disclosure, Ivanti said it knew of no exploited customers but that "a Proof of Concept is publicly available." Its [August security update](https://www.ivanti.com/blog/august-security-update) post shipped the fix alongside other products.

Part of the fix was already out. Ivanti says 22.2R1 (March 26, 2024) and 22.7R2 (May 20, 2024) contained it, which is why the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-7593) describes every version "other than 22.2R1 or 22.7R2" as affected. Fixes for 22.3, 22.5 and 22.6 followed on August 19, the day [Censys](https://censys.com/advisory/cve-2024-7593/) counted 97 exposed vTM devices online. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593) on September 24, 2024. As [Help Net Security](https://www.helpnetsecurity.com/2024/09/25/cve-2024-7593-exploited/) noted, neither CISA nor Ivanti described the attacks. CISA has not said what exploitation prompted the listing.

## Who is affected

Self-managed vTM 22.2 (fixed in 22.2R1), 22.3 and 22.3R2 (fixed in 22.3R3), 22.5R1 (22.5R2), 22.6R1 (22.6R2) and 22.7R1 (22.7R2). The bug is reachable only through the admin interface. Exposure therefore depends on where the admin server listens. Ivanti says customers who bound it to an internal network or private IP "significantly reduced their attack surface."

## Do you really need to act?

If you patched in 2024, this bug is closed. The catch is lifecycle. Ivanti's [support schedule](https://hub.ivanti.com/s/article/Product-End-of-Support-End-of-Engineering-Schedule-Pulse-Secure-Traffic-Manager-vTM?language=en_US) gives a release 12 months of support, or 36 for long-term-support (LTS) releases. 22.2r1 LTS reached end of support on January 19, 2026, and 22.8R2 on April 15, 2026. Only 22.9 LTS, supported until July 15, 2028, remains. A box fixed on 22.3R3, 22.5R2, 22.6R2 or 22.7R2 is now on unsupported code and will not get the next fix.

A vTM still below a fixed build, with its admin interface reachable from an untrusted network, is a different matter. The exploit is public and needs no credentials, and it leaves an attacker-controlled admin on the device that routes your production traffic. Treat it as possibly compromised.

## What to do now

1. Inventory every vTM instance and record its version, including lab and cloud copies.
2. Upgrade anything below 22.2R1, 22.3R3, 22.5R2, 22.6R2 or 22.7R2 now, then schedule the move to 22.9.
3. Apply Ivanti's mitigation. Under **System > Security**, open **Management IP Address and Admin Server Port** and set `bindip` to the management interface IP. Use the setting above it to allow only trusted addresses.
4. Audit administrators and the audit log as described below. Delete unknown accounts and change all admin passwords.
5. If you find a rogue admin, rebuild from a clean image and rotate the certificates and backend credentials held in the configuration.

## How to tell if you were hit

Ivanti's advisory shows how exploit-created admins look in the audit log output. A legitimate addition records who did it, for example `USER=admin GROUP=admin AUTH=local IP=… OPERATION=adduser MODUSER=user1 MODGROUP=admin`. An account added by the exploit has those fields empty: `USER=!!ABSENT!! GROUP=!!ABSENT!! AUTH=!!ABSENT!! IP=!!ABSENT!! OPERATION=adduser`. Export the audit log and run `grep -F 'USER=!!ABSENT!!' audit.log | grep adduser`, going back to at least August 2024. Then compare the current admin list with your records. Review configuration changes made after any unexplained account appeared.

## Timeline

- Mar 26, 2024 — vTM 22.2R1 ships, already containing the fix.
- May 20, 2024 — vTM 22.7R2 ships, also fixed.
- Aug 12, 2024 — Ivanti publishes the advisory and notes a public proof of concept.
- Aug 19, 2024 — 22.3R3, 22.5R2 and 22.6R2 ship. Censys counts 97 exposed vTM devices.
- Sep 24, 2024 — CISA adds CVE-2024-7593 to KEV, with an October 15 federal deadline.
- Jan 19, 2026 — vTM 22.2r1 LTS reaches end of support.
- Apr 15, 2026 — vTM 22.8R2 reaches end of support, leaving 22.9 as the only supported line.

## Sources

1. [Ivanti — Security Advisory: Ivanti Virtual Traffic Manager (vTM) (CVE-2024-7593)](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593?language=en_US)
2. [Ivanti — Product End of Support / End of Engineering Schedule: Ivanti virtual Traffic Manager (vTM)](https://hub.ivanti.com/s/article/Product-End-of-Support-End-of-Engineering-Schedule-Pulse-Secure-Traffic-Manager-vTM?language=en_US)
3. [Ivanti — August 2024 Security Update](https://www.ivanti.com/blog/august-security-update)
4. [CVE record — CVE-2024-7593](https://www.cve.org/CVERecord?id=CVE-2024-7593)
5. [NVD — CVE-2024-7593](https://nvd.nist.gov/vuln/detail/CVE-2024-7593)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-7593](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593)
7. [Censys — Authentication Bypass in Ivanti vTM (CVE-2024-7593)](https://censys.com/advisory/cve-2024-7593/)
8. [Help Net Security — Ivanti vTM auth bypass flaw exploited in attacks, CISA warns](https://www.helpnetsecurity.com/2024/09/25/cve-2024-7593-exploited/)

---
Source page: https://erroneo.us/security/briefs/ivanti-vtm-cve-2024-7593-admin-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt