CVE-2024-9167 | Ivanti Velocity - License Server Operational Intel

Executive Risk Summary

"A local authenticated attacker can exploit insecure permissions in Ivanti Velocity License Server before version 5.2 to achieve local privilege escalation. This vulnerability poses a significant risk to system integrity and security, as an attacker could potentially gain elevated privileges and access sensitive data or disrupt system operations."

Operational Audit Arsenal

Target Type Service

Target Asset Ivanti Velocity License Server

Standard Path %programfiles%\Ivanti\Velocity\LicenseServer

PowerShell

# 🛠️ Senior Engineer Universal Audit
# Target: Ivanti Velocity License Server (Service)
$Targets = 'Ivanti Velocity License Server'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")

Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue | 
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

CVE-2024-9167: Ivanti Velocity License Server local privilege escalation vulnerability. Apply version 5.2 or later to mitigate risk.

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://forums.ivanti.com/s/article/Security-Advisory-Velocity-License-Server-CVE-2024-9167

Related Ivanti Threats

CVE-2024-11639 CVSS 10

Ivanti Cloud Services Application - Admin Web Console

CVE-2025-22467 CVSS 9.9

Ivanti Connect Secure - Connect Secure

CVE-2023-46808 CVSS 9.9

Ivanti Neurons for ITSM - File Upload Component

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.