What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning regarding an actively exploited security flaw in Ivanti Connect Secure (ICS). Since at least October 1st, attackers have been exploiting this vulnerability as a zero-day attack, with no patch available at the time of disclosure. The vulnerability has been confirmed to be exploited in the wild, indicating its real and immediate threat to affected systems.
Who is affected
Organisations running Ivanti Connect Secure are at risk from this flaw. The impact extends to any deployment utilising this product, especially where the compromised component facilitates remote access or authentication services. Due to the nature of the exploitation, affected systems are vulnerable to unauthorised access, potentially leading to data breaches or further exploitation within the affected environment.
Recommended actions
Implement immediate mitigation measures to restrict network access to Ivanti Connect Secure components, particularly limiting external access where possible.
Monitor network traffic for indicators of exploitation or suspicious activity related to Ivanti Connect Secure.
Keep informed about updates from Ivanti regarding patches or workarounds for this vulnerability, as vendor fixes become available.
Review security policies and access configurations to minimise the attack surface, especially around remote access services.
