CVE-2024-20399 - Vulnerability Details

Threat entity extracted from intelligence sources

Frequency
2
occurrences
First Seen
November 10, 2025
Last Seen
June 24, 2026

CVE-2024-20399 is a vulnerability tracked by ThreatCluster, appearing in 3 threat clusters built from 2 intelligence report mentions.

CVE-2024-20399 is a vulnerability tracked across 3 threat clusters and 2 intelligence report mentions on ThreatCluster. First observed November 10, 2025; most recent activity June 24, 2026.

Related Threat Clusters

  • Operation Highland: Velvet Ant's Decade-Long Espionage Campaign

    Operation Highland, attributed to the Velvet Ant cyberespionage group, involved a sophisticated attack that began in 2016 and persisted undetected for a decade. The attackers hijacked the authentication stack of a major…

    9 articles · Updated June 13, 2026
  • Critical Cisco ISE Flaw Enables Remote Denial-of-Service Attacks

    A critical vulnerability in Cisco's Identity Services Engine (ISE), tracked as CVE-2024-20399, allows unauthenticated remote attackers to trigger system restarts, leading to denial-of-service conditions. The flaw…

    1 article · Updated November 10, 2025
  • Critical Cisco ISE Vulnerability Causes System Crashes

    A critical denial-of-service vulnerability in Cisco's Identity Services Engine (ISE) has been identified, allowing unauthenticated attackers to crash the system. The flaw, tracked as CVE-2024-20399, affects ISE versions…

    1 article · Updated November 10, 2025

Recent Intelligence Reports

  • Operation Highland Velvet Ant — www.sygnia.co · June 24, 2026
  • Critical Cisco ISE flaw triggers system crashes — Scworld · November 10, 2025

Frequently asked questions

What is CVE-2024-20399?

CVE-2024-20399 is a vulnerability tracked by ThreatCluster, appearing in 3 threat clusters built from 2 intelligence report mentions.

Is CVE-2024-20399 still active?

The most recent intelligence report mentioning CVE-2024-20399 on ThreatCluster is dated June 24, 2026. Activity was first observed November 10, 2025, giving a tracked span from then to June 24, 2026.

What is CVE-2024-20399 associated with?

Across ThreatCluster reporting, CVE-2024-20399 most frequently co-occurs with DDoS, Malware, Operation Highland, China, CWE-287 - Improper Authentication, among 12 tracked related entities.

What are the latest developments involving CVE-2024-20399?

The most significant recent cluster is “Operation Highland: Velvet Ant's Decade-Long Espionage Campaign” (9 articles · Updated June 13, 2026). CVE-2024-20399 appears across 3 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on CVE-2024-20399?

CVE-2024-20399 appears in 2 intelligence report mentions across 3 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown