Ivanti and Juniper Networks accused of bending the rules with CVE assignments

Infosec criticism has arisen after Juniper allegedly patched multiple serious vulnerabilities without assigning CVE IDs or issuing separate advisories, and Ivanti was accused of bundling several command-injection/remote-code-execution flaws under a single CVE (CVE-2024-21887). The report highlights concerns about transparency, CVE allocation rules, and the balance between coordinated disclosure and customer protection; patches were issued but questions remain about timely CVE registration and independent fixability.