🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2021-44529

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

Attack Vector

Network

Privileges Req.

None

User Interaction

None

ivanti epmendpoint_manager_cloud_services_appliance

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-44529 Scanner

Targets the Self-Service Portal endpoint; unauthenticated attackers can inject arbitrary code with limited permissions, potentially leading to full system compromise.

Used 3k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: ivanti epm

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →