Ivanti Connect Secure zero-day vulnerabilities

Ivanti has released security patches addressing two zero-day vulnerabilities in its Connect Secure VPN appliances. The vulnerabilities were reportedly chained together by threat actors to facilitate unauthorized access and exploitation of enterprise environments. Organizations should prioritize patching these appliances to remediate the potential for initial access and persistence.

Impact

Observed exploitation indicates these vulnerabilities allow for initial access and execution, potentially enabling threat actors to establish persistence within compromised enterprise networks.

Recommendation

• Inventory all Ivanti Connect Secure appliances within the environment.
• Apply the latest patches released by Ivanti for Connect Secure immediately.
• Review VPN appliance logs for anomalous administrative access or unexpected process execution.
• Monitor for unauthorized lateral movement originating from the VPN appliance network segment.