Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HIvanti Application Control
APPIvanti2023.32024.12024.3≤ 2023.3
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
LPE
Related vulnerabilities
CVE-2024-10630HIGH7.8ten sam produkt
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated at...
CVE-2026-10520CRITICAL10.0⚠ KEVPL ✓ten sam vendor
RCE poprzez OS Command Injection w Ivanti Sentry (nieuwierzytelniony dostęp root)
CVE-2026-1281CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Krytyczny code injection w Ivanti Endpoint Manager Mobile (RCE bez uwierzytelnienia)
CVE-2026-1340CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Code injection w Ivanti EPMM umożliwiający nieuwierzytelniony RCE
CVE-2025-22457CRITICAL9.0⚠ KEVPL ✓ten sam vendor
Stack-based buffer overflow w Ivanti Connect Secure, Policy Secure i ZTA Gateways umożliwiający RCE