CISA Flags Active Exploitation of Ivanti Connect Secure and Drupal Commerce Flaws

Key points

• Attackers are actively exploiting known flaws in Ivanti Connect Secure and Drupal Commerce.
• CISA added both products to its known exploited vulnerabilities catalog.
• Security Affairs covered the activity in its weekly newsletter.
• No CVE identifiers were provided in the notice.
• Admins should prioritize patching and exposure checks.

Security Affairs used its weekly newsletter to report that attackers are actively exploiting known vulnerabilities in two products: Ivanti Connect Secure and Drupal Commerce. CISA responded by adding the products to its catalog of vulnerabilities known to be exploited in the wild. The notice did not include any CVE identifiers, leaving defenders to rely on vendor advisories and product versions for precise mapping.

The affected systems are typically internet-facing. Ivanti Connect Secure is used for remote access, while Drupal Commerce powers online storefronts and transactions. That exposure makes both attractive to attackers. Active exploitation means the risk is not theoretical; the CISA catalog addition is a signal that exploitation has been confirmed. Organizations running either product should treat the report as operationally relevant, even without CVE details.

Why it matters: remote-access gateways and commerce platforms sit at trust boundaries. A successful compromise can give attackers a foothold for lateral movement, credential theft, or transaction manipulation. Known exploited vulnerabilities are often prioritized by adversaries because public confirmation reduces uncertainty. The weekly newsletter release and catalog addition are informational actions, but they describe active attack activity.

What to watch: vendor advisories for Ivanti Connect Secure and Drupal Commerce, CISA catalog updates, and follow-up from Security Affairs. Because no CVE identifiers were provided, scanners may not flag exposure; manual version checks and log review are necessary. Look for unusual authentication, new administrative accounts, or unexpected changes to commerce workflows. Escalate suspected compromise to incident response.

What to do now

1. Inventory all internet-facing Ivanti Connect Secure and Drupal Commerce instances and verify versions against current vendor advisories.
2. Apply vendor patches or mitigations immediately; if no patch is available, restrict access to trusted networks or disable exposed services.
3. Review the CISA known exploited vulnerabilities catalog and Security Affairs weekly newsletter for follow-up details, noting that no CVE identifiers were provided.
4. Hunt for signs of exploitation in authentication logs, administrative account changes, webshells, and unexpected commerce workflow modifications.
5. Enforce MFA and least privilege on remote-access gateways, and segment Drupal Commerce admin interfaces from public traffic.
6. Monitor vendor and CISA updates closely, and subscribe to Security Affairs' weekly newsletter for further exploitation reporting.
7. If compromise is suspected, isolate affected systems, preserve logs, and engage incident response before restoring services.

Original source

Security Affairs