CVE-2024-10630

HIGH

Ivanti Application Control Engine <10.14.4.0 - Privilege Escalation

Title source: llm

Description

A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.

References (1)

Core 1

Core References

Mitigation, Vendor Advisory

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Application-Control-Engine-CVE-2024-10630

Scores

CVSS v3 7.8

EPSS 0.0006

EPSS Percentile 17.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-366

Status published

Products (5)

ivanti/application_control 2023.3 (3 CPE variants)

ivanti/application_control 2024.1 (2 CPE variants)

ivanti/application_control 2024.3

ivanti/application_control < 2023.3 (2 CPE variants)

ivanti/security_controls < 2024.4.1

Published Jan 14, 2025

Tracked Since Feb 18, 2026