How severe is CVE-2024-9537?

CVE-2024-9537 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 3.8% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2024-9537: ScienceLogic SL1 unspecified vulnerability

CISA Known Exploited Vulnerabilities

ScienceLogic SL1 Unspecified Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2024-10-21

Remediation due

2024-11-11

Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA notes
https://support.sciencelogic.com/s/article/15527 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9537

Description

ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.

Severity

CVSS 3.1 · CNA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0 · CNA9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Exploitation Context

as of October 14, 2026

All KEV statistics→

CISA added CVE-2024-9537 to the KEV catalog 3 days after its CVE record was published. The median for entries added in 2024 is 21.5 days.
Its current EPSS score (3.8%) is higher than that of 15% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
ScienceLogic	ScienceLogic SL1	0 to <12.1.3 0 to <12.2.3 0 to <12.3 0 to <10.1.x 0 to <10.2.x 0 to <11.1.x 0 to <11.2.x 0 to <11.3.x

References

9 Links

Vendor advisories

Third-party advisories

https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility/

Government resources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9537

Release notes

https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690

Other references

Record Details

Published

2024-10-18

Last updated

2025-10-21

Assigner (CNA)

cisa-cg

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.