Urgent Action Required: Multiple Threat Actors Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure Products

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging Federal Civilian Executive Branch (FCEB) agencies to take immediate action against two actively exploited zero-day flaws in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) products. These vulnerabilities, an authentication bypass (CVE-2023-46805) and a code injection bug (CVE-2024-21887), have become the target of widespread exploitation by multiple threat actors.

Description of the vulnerabilities

The authentication bypass flaw allows malicious actors to circumvent the security measures in the affected products, granting them unauthorized access. On the other hand, the code injection bug enables attackers to craft malicious requests and execute arbitrary commands on the system. This combination of flaws poses a significant threat to the security and integrity of the affected systems.

Increase in threat actor activity

After the vulnerabilities were publicly disclosed, Ivanti noticed a sharp increase in threat actor activity, with attacks intensifying from January 11, 2024. This development highlights the significance and severity of the flaws, and the urgent need for organizations to address them promptly.

Potential impact and consequences

Successful exploitation of these vulnerabilities can have severe consequences. Attackers can move laterally within the system, infiltrate data, and establish persistent access. This ultimately leads to the full compromise of target information systems, putting sensitive data, infrastructure, and even national security at risk.

Mitigations urged by CISA

CISA’s emergency directive emphasizes the need for organizations running ICS to implement the recommended mitigations immediately. Additionally, organizations are advised to use the External Integrity Checker Tool to detect any signs of compromise. If compromise is detected, disconnecting the affected devices from networks, resetting them, and importing the provided XML file are crucial steps to minimize the damage.

Additional security measures

To further enhance security, FCEB entities are urged to revoke and reissue any stored certificates. Resetting the admin enable password and securely storing API keys are essential steps in preventing further unauthorized access. It is also recommended to reset the passwords of any locally defined users on the gateway, ensuring thorough cleaning and securing of the affected systems.

Observations by cybersecurity firms

Cybersecurity firms, including Volexity and Mandiant, have reported attacks that exploit these vulnerabilities. Threat actors have leveraged the flaws to deploy web shells and passive backdoors, enabling persistent access to compromised devices. Shockingly, it is estimated that approximately 2,100 devices worldwide have already fallen victim to these attacks, underscoring the urgent need for action.

Opportunistic Exploitation for Financial Gain

Notably, GreyNoise, a threat intelligence firm, has observed bad actors exploiting these vulnerabilities for financial gain. In addition to deploying backdoors, attackers have used the flaws to drop malicious XMRig cryptocurrency miners. This opportunistic exploitation demonstrates the need for vigilance and proactive measures to safeguard against monetary incentives that drive further attacks.

The urgency to address and mitigate the zero-day flaws in Ivanti Connect Secure and Policy Secure products cannot be overstated. Organizations must act swiftly to implement the recommended mitigations and security measures to protect their systems from compromise. The collaboration between CISA, Ivanti, and cybersecurity firms highlights the seriousness of these vulnerabilities and the collective effort required to defend against them. Proactive measures and constant monitoring are indispensable in the current threat landscape, ensuring that organizations stay one step ahead of malicious actors seeking to exploit vulnerabilities for their gain.

Explore more

Top Blockchain Stocks Trending: Oracle to Bitdeer

As blockchain technology expands its footprint across various industries, investors have turned their attention toward companies that drive innovation in digital transaction systems. Blockchain stocks are becoming increasingly attractive for investors looking to capitalize on the expected growth in decentralized and secure digital networks. Publicly traded companies involved in developing, utilizing, or facilitating blockchain technology and applications often demonstrate robust

Fitness Marketing Strategies for Wellness Business Growth

The health and wellness industry has reached unprecedented heights with a growing number of fitness facilities and an expanding clientele prioritizing physical well-being. As of 2025, the industry has burgeoned to over 55,000 fitness facilities in the United States, reflecting an upward trend expected to significantly influence the market through 2029. To navigate this fiercely competitive space, fitness entrepreneurs must

How Will Email Deliverability Tools Shape Marketing by 2030?

In the rapidly evolving landscape of digital marketing, the importance of email as a communication tool has continually surged, requiring marketers to adapt to the changing demands. By 2030, email deliverability tools are set to reshape the marketing realm by offering advanced solutions to ensure messages reach their intended recipients effectively and consistently. This market, poised for remarkable growth, is

Kioxia Unveils High-Performance PCIe 5.0 NVMe SSDs for AI Centers

As artificial intelligence and high-performance computing continue to shape the future of technology, the demands on data center infrastructure have never been higher. Kioxia Corporation, a leader in storage solutions, has introduced its latest contribution to this rapidly evolving landscape – the KIOXIA CD9P Series PCIe 5.0 NVMe SSDs. These state-of-the-art solid-state drives (SSDs) are designed to cater specifically to

How Are Chip Innovations Fueling AI and Data Center Growth?

In an era where technological evolution drives every industry forward, the spotlight is firmly set on the profound growth of artificial intelligence and the corresponding expansion of data centers. The burgeoning demand for faster and more efficient data processing solutions has led to significant leaps in semiconductor technology. Key to these advancements are innovations in System on Chip (SoC), three-dimensional