Ivanti VPN Zero-Day Exploits: State-Sponsored Hackers at Work

Hackers are actively exploiting two critical zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN appliance, to bypass two-factor authentication and execute malicious code inside networks. The vulnerabilities, tracked as CVE-2023-46805 and CVE-2024-21887, allow attackers to run commands on the system, steal configuration data, modify files, and gain unfettered access to systems on the network. The attacks are attributed to a threat actor suspected to be a Chinese nation-state-level actor, and there are approximately 15,000 affected Ivanti appliances exposed to the Internet. Organizations using Ivanti Connect Secure are urged to take immediate action to mitigate the vulnerabilities.