CVE-2021-44529 - AskarLabs CVE Database

CVE-2021-44529

Vendor N/A

Product Ivanti EPM

Weakness CWE-94 · Code injection

KEV Status Known Exploited

Ransomware Used in campaigns

Published December 8, 2021

Last update October 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

December 8, 2021 CVE published

October 21, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-44529 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html CISA KEV Reference https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2021-44529