Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways 10 Jan 2024

ronjor · Jan 10, 2024

Release Date January 10, 2024

Ivanti has released a security update to address an authentication bypass vulnerability (CVE-2023-46805) and a command injection vulnerability (CVE-2024-21887) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways. A cyber threat actor could exploit these vulnerabilities to take control of an affected system.
Click to expand...

Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887.
CISA urges users and administrators to immediately review Ivanti's security update and apply the current workaround. CISA will update this alert as Ivanti releases patches.
Click to expand...

stapp · Jan 24, 2024

Mass exploitation of Ivanti VPNs is infecting networks around the globe
Orgs that haven't acted yet should, even if it means suspending VPN services.
Click to expand...

https://arstechnica.com/security/20...-around-the-globe/?comments=1&comments-page=1

ronjor · Jan 31, 2024

Updated: New Software Updates and Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways

Last Revised January 31, 2024
CISA urges organizations to follow the updated guidance—including software updates—that Ivanti has published to their KB article, which includes:
Two additional vulnerabilities in all supported versions (9.x and 22.x) of Ivanti Connect Secure and Policy Secure Gateways:
Click to expand...

Log in or Sign up

Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways 10 Jan 2024

ronjor Global Moderator

stapp Global Moderator

ronjor Global Moderator

Log in or Sign up

Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways 10 Jan 2024

ronjor Global Moderator

stapp Global Moderator

ronjor Global Moderator

Useful Searches