Ivanti’s Never-Ending Story: New Vulns, Same Old Headaches
Just when you thought it was safe to go back into the network, Ivanti is back in the spotlight, and not for a good reason. Their Connect Secure and Policy Secure gateways continue to be a hotbed for critical vulnerabilities, keeping security teams on their toes and threat actors very, very busy.[1]
For months now, these widely used VPN and network access control appliances have been under relentless attack. Initial exploits targeted CVE-2023-46805 (an authentication bypass) and CVE-2024-21887 (a command injection), allowing attackers to bypass authentication and execute commands. But it didn’t stop there. We’ve seen a parade of new vulnerabilities, including CVE-2024-21888 (privilege escalation), CVE-2024-21893 (server-side request forgery), and most recently, CVE-2024-22024 (an XML external entity vulnerability leading to arbitrary file reading).[2]
The “So What?” here is massive. These aren’t just theoretical exploits; they are being actively weaponized by multiple sophisticated threat actors, including state-sponsored groups and financially motivated cybercriminals.[3] Compromising an Ivanti appliance often grants attackers a foothold directly into the corporate network, bypassing traditional perimeter defenses. This can lead to data exfiltration, lateral movement, and even ransomware deployment. If your organization uses these devices, you’re not just patching; you’re in a race against time. Ivanti’s own advice has included not just patching, but performing factory resets in some cases to ensure persistence mechanisms are removed.[4]
Look, this whole saga is a brutal reminder: securing your network edge is paramount. These devices are internet-facing, often poorly monitored, and represent a single point of failure that can undo layers of internal security. Patch immediately, but also assume compromise and hunt for threats. Your perimeter is only as strong as its weakest, most exposed link.
