Threat Brief: Multiple Ivanti Vulnerabilities (Updated Feb. 29)
Summary: Ivanti disclosed five High or Critical vulnerabilities since January 2024 in its Connect Secure, Policy Secure and Neurons for ZTA gateways, including an authentication bypass (CVE-2023-46805), a command injection flaw (CVE-2024-21887), a privilege escalation flaw (CVE-2024-21888), and two SAML-component flaws (CVE-2024-21893 and CVE-2024-22024). Unit 42 observed 28,474 exposed instances across 145 countries between Jan. 26-30, 2024, and 610 compromised devices in 44 countries as of Jan. 23, with exploitation traced to a likely China-nexus actor and CISA ordering U.S. federal agencies to disconnect the products by 11:59 PM on Feb. 2, 2024.
Key Takeaway: A joint government advisory states threat actors can deceive Ivanti's Integrity Checker Tools so compromises go undetected and can maintain root-level persistence even after factory resets, meaning removing malicious administrator accounts may not clear the intrusion. With 28,474 exposed instances in 145 countries and 610 already compromised, the question is whether your gateways are among them and whether a clean scan is something you can actually trust.