Agencies using vulnerable Ivanti products have until Saturday to disconnect them
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate… | 8.8 | 87% | ||
| CVE-2024-21893 | SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component | 8.2 | 100% | KEVRansomware | KEV |
From the original article
2 min read at arstechnica.com
Federal civilian agencies have until midnight Saturday morning to sever all network connections to Ivanti VPN software, which is currently under mass exploitation by multiple threat groups. The US Cybersecurity and Infrastructure Security Agency mandated the move on Wednesday after disclosing three critical vulnerabilities in recent weeks.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.