Active Exploitation of Ivanti Connect Secure VPN RCE Flaws

Attackers globally exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure gateways, chaining the flaws to achieve unauthenticated remote code execution with administrator privileges. The affected products included supported Connect Secure 9.x and 22.x releases and supported Policy Secure versions; because the appliances are commonly internet-facing, compromise could enable data theft, lateral movement, and ransomware deployment.

Ivanti issued updates for specified Connect Secure and ZTA versions, while CISA warned that the vendor's initial mitigations and detection guidance might not fully address the threat. Ivanti also disclosed CVE-2024-21888 and CVE-2024-21893, for which proof-of-concept code became public; organizations were urged to apply updates immediately, factory-reset affected appliances where recommended, and use mitigations only until patches could be installed.