Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

volexity.com · 10 Jan 2024 · Licence: not cleared; local research copy only

CVEs this report names

2 CVEs

CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more · 4 reports
>99.9%Top 0.01%
88.4priority
CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing Application T1078Valid Accounts+2 more · 4 reports
>99.9%Top 0.02%
87.7priority

CVE-2024-21887 – a command-injection vulnerability found into multiple web components with a CVSS score of 9.1

CVE-2023-46805 – an authentication-bypass vulnerability with a CVSS score of 8.2

None

No passage in this report has been tied to an ATT&CK technique.