Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways

Summary: Ivanti Security Update for Connect Secure and Policy Secure Gateways

Ivanti has released a security update to address two critical vulnerabilities in its Connect Secure and Policy Secure gateways: an authentication bypass vulnerability (CVE-2023-46805) and a command injection vulnerability (CVE-2024-21887). These vulnerabilities affect all supported versions (9.x and 22.x) of the gateways and, if exploited, could grant a cyber threat actor control over an affected system.

Ivanti reports active exploitation of both vulnerabilities, emphasizing the need for immediate action. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities Catalog, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate the identified vulnerabilities by the specified due date to protect FCEB networks against active threats.

To mitigate the risk, CISA urges users and administrators to:

1. Apply the current workaround in Ivanti’s security update as soon as possible.
2. Review Volexity’s blog on these vulnerabilities for additional information and guidance.

CISA will update this alert as Ivanti releases patches. It is essential for organizations using Ivanti Connect Secure and Policy Secure gateways to take immediate action and ensure the security of their networks.

Key Takeaways:

Two critical vulnerabilities (CVE-2023-46805 and CVE-2024-21887) in Ivanti Connect Secure and Policy Secure gateways require urgent attention.
Active exploitation of both vulnerabilities has been reported.
CISA has added both CVEs to its Known Exploited Vulnerabilities Catalog, requiring FCEB agencies to remediate by the specified due date.
Apply the current workaround and review Volexity’s blog for additional information.
CISA will update this alert as Ivanti releases patches.

Recommendation:*

Organizations using Ivanti Connect Secure and Policy Secure gateways should prioritize the implementation of the security update and apply the workaround as soon as possible to minimize the risk of exploitation.