Our takeCISA added two Ivanti Connect Secure flaws to its KEV catalog after confirmed in-the-wild chaining with a third for unauthenticated root. Patch the fixed ones now if you run it; Ivanti should ship the last one immediately.Security Resilience desk
Sources (2)
- hackernews · hackernews
- govcert_hk · govcert_hk
What this means for you — Security leader:CISA added two of the three chained Ivanti Connect Secure flaws to its KEV catalog: both are confirmed exploited in the wild for unauthenticated root access. Patch immediately if you run self-hosted ICS.
What this means for you — Lean IT orgs:If you run Ivanti Connect Secure yourself, apply the latest patches right away. Attackers are actively chaining these flaws to take full control with no login.
What this means for you — MSP:Check every client running self-hosted Ivanti Connect Secure and confirm the latest patches are applied. Two of the three chained unauthenticated root flaws are now confirmed exploited in the wild.
What this means for you — Researcher:CISA added two of the three chained Ivanti Connect Secure CVEs to KEV after in-the-wild exploitation. Full chain reaches unauthenticated root; patch the fixed ones now and watch for the third.