Ivanti Exploit Nightmare Continues: Why Your VPN Is Still A Target
The Ivanti Connect Secure and Policy Secure VPN appliances are once again in the spotlight, and not for good reasons. Despite multiple patches, threat actors are still finding ways to exploit these critical gateways, making them a persistent headache for security teams worldwide.
This isn’t a single vulnerability, but a chain of critical flaws. We’re talking CVE-2023-46805 (authentication bypass), CVE-2024-21887 (command injection), CVE-2024-21888 (privilege escalation), CVE-2024-21893 (SSRF), and the recently patched CVE-2024-22024 (XML external entity)[1]. State-sponsored groups like ‘UNC5221’ (tracked by Mandiant) have been hammering these devices, deploying web shells, backdoors, and credential stealers[2]. Even after patches, new attack vectors or variations are being discovered, proving how sophisticated and determined these adversaries are[3].
If your organization uses Ivanti Connect Secure or Policy Secure, this isn’t just background noise – it
