Ivanti fixes two exploited remote-access flaws in Connect Secure and ICS gateway

En bref

• Two Ivanti remote-access weaknesses were exploited as zero-days.
• Attackers linked the vulnerabilities together in intrusion activity.
• Affected products include Connect Secure and the ICS remote-access gateway.
• Vendor fixes are available; exposed gateways should be prioritized.
• No CVE identifiers were provided in the source facts.

Ivanti has published fixes for a pair of weaknesses in its remote-access products, Connect Secure and the ICS gateway. According to the available facts, both issues have been used in real-world attacks as zero-days, and adversaries linked them together during intrusions observed from the first day of October onward. No CVE identifiers were included in the source information, so defenders should consult Ivanti’s advisory for version-specific details.

The exposure is concentrated in organizations that publish these appliances to the internet for remote work and third-party access. K-12 districts and government agencies often rely on such gateways to connect staff, contractors, and managed service providers, which makes an unpatched device a potential entry point into internal networks. Because the flaws are remote-access related, exploitation can blend into normal VPN and administrative traffic.

Why this matters: a chained zero-day campaign against an edge device can give attackers a foothold before signatures or public indicators exist. Even after patches are available, the window between exploitation and remediation is dangerous, especially where change control or maintenance schedules delay upgrades. The absence of CVE numbers in the facts does not reduce urgency; it means administrators must map affected versions directly from vendor guidance.

What to watch: Ivanti’s advisories for updated CVE assignments and revised mitigation guidance, anomalous authentication patterns, new or modified accounts, unexpected configuration changes, and sessions originating from unusual locations. Treat any suspicious activity on an affected gateway as a potential compromise until logs and system integrity checks prove otherwise.

À faire maintenant

1. Inventory every Connect Secure and ICS gateway instance, including internet-facing, clustered, and backup nodes, and record current firmware versions.
2. Apply the latest Ivanti security updates immediately, following the vendor’s upgrade and reboot sequence for each product.
3. If patching cannot be completed at once, reduce exposure by restricting management interfaces, limiting remote-access paths, enforcing MFA, and segmenting the gateway from critical systems.
4. Hunt for signs of chained exploitation by reviewing VPN, authentication, and administrative logs from October 1 onward for anomalous sessions, new accounts, and configuration changes.
5. Reset credentials and revoke active sessions for accounts that used affected gateways, and rotate secrets if compromise is suspected.
6. Monitor Ivanti advisories for CVE identifiers and updated guidance, and subscribe to vendor notifications for revised indicators or mitigations.
7. Validate backups and incident-response contacts; isolate any suspicious appliance and engage IR support if logs show unauthorized access.

Source originale

BleepingComputer