New Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways

Here is a summary of the document:

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert to provide mitigations for threat actors exploiting vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways. The vulnerabilities (CVE-2023-46805 and CVE-2024-21887) allow threat actors to capture credentials and drop webshells, compromising enterprise networks. CISA recommends continuous threat hunting, monitoring authentication and identity management services, and isolating affected systems. After applying patches, CISA suggests continued network hunting to detect potential pre-patch compromises.