Multiple vulnerabilities within Ivanti Connect Secure and Ivanti Policy Secure gateways

The authoring organisations and industry partners have observed persistent targeting by a variety of cyber threat actors of these vulnerabilities: 

• CVE-2023-46805 External Link ,  
• CVE-2024-21887,   External Link
• CVE-2024-22024 External Link , and  
• CVE-2024-21893.  External Link

The vulnerabilities can be used in a chain of exploits to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges. Exploiting them may enable: 

• lateral movement,  
• data exfiltration,
• web shell deployment,
• credential theft (including domain administrators), and
• persistent access on a target network. 

This joint advisory provides technical details on observed tactics used by these threat actors and indicators of compromise to help organisations detect malicious activity. All organisations using these devices should assume a sophisticated threat actor could gain persistence and remain dormant before launching an attack. Organisations are urged to exercise caution when assessing the risks of continuing to operate these devices. 

To help organisations understand the impact of this threat, the joint advisory includes key findings from testing conducted by CISA from an attacker’s perspective.

“This advisory clearly shows that malicious actors are continuing to seek out, and actively exploit, vulnerabilities in commonly used technology and software,” says Rob Pope, Director CERT NZ, part of New Zealand's NCSC. 

“Businesses need to stay alert to these vulnerabilities and immediately follow all steps to mitigate or prevent attacks from happening. We strongly recommend that anyone working in the IT sector sign up for updates from their country’s cyber security agencies to stay ahead of the bad guys.” 

The NCSC, along with our partners, recommends that software manufacturers adopt secure-by-design and secure-by-default principles in their development practices. Following these principles will reduce the number and impact of avoidable vulnerabilities and insecure configurations that put organisations at risk. 

All organisations are urged to review the advisory and implement recommended actions and mitigations.