CISA: Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways
Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways
Ivanti has released a security update to address an authentication bypass vulnerability (CVE-2023-46805) and a command injection vulnerability (CVE-2024-21887) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways. A cyber threat actor could exploit these vulnerabilities to take control of an affected system.
Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887.
CISA urges users and administrators to immediately apply the current workaround in Ivanti’s security update and review Ivanti’s KB article, Volexity’s blog and Mandiant’s blog on these vulnerabilities. Note: CISA has added CVE-2023-46805 and CVE-2024-21887 to its Known Exploited Vulnerabilities Catalog, which, per Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the specified due date to protect FCEB networks against active threats.
CISA will update this alert as Ivanti releases patches.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
