What happened
Ivanti has issued a warning regarding a zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. This vulnerability is actively exploited in ongoing attacks, with confirmed cases of exploitation in the wild. At the time of disclosure, no official patch was available from the vendor to address this flaw. The vulnerability’s exploitation involves specific attack methods that leverage the weaknesses in the ICS component, which may allow unauthenticated remote actors to execute arbitrary code or gain unauthorised access. The severity of this issue has been rated as high due to its active exploitation status and the potential for significant impact on affected systems.
Who is affected
Organisations running Ivanti Connect Secure are potentially impacted by this security flaw. Affected deployments include any instance of the Ivanti Connect Secure remote access gateway where the vulnerability exists. The risk is particularly high for those systems that are exposed to the internet without adequate protective measures, increasing the likelihood of successful exploitation by threat actors.
Recommended actions
Immediately review the security posture of Ivanti Connect Secure environments.
Apply all available security updates and patches provided by Ivanti once they are released, particularly those aimed at mitigating this zero-day vulnerability.
Implement network controls to restrict access to the Connect Secure gateways, especially from untrusted sources.
Monitor network traffic and logs for unusual activity that could indicate an attempted or successful exploitation of this vulnerability.
