Ivanti issues Friday out‑of‑band fixes for critical Connect Secure VPN flaw after detected exploitation
Marcus Webb ·
Ivanti on Friday released out of band updates for Connect Secure and Policy Secure gateways to address a critical vulnerability that allows unauthenticated command execution on affected devices. The company said it has observed limited exploitation in the wild and urged administrators to patch immediately, especially for internet facing portals.
The timing matters because these appliances often remain exposed over weekends. Attackers consistently target remote access gear for initial entry, and past Ivanti VPN bugs have been used by both espionage actors and ransomware crews.
What is affected
Ivanti said supported branches of Connect Secure and Policy Secure receive fixed builds today. Older and end of support versions do not receive direct fixes. The company published a temporary mitigation that disables vulnerable web components and updates request filtering until patching is possible.
The flaw originates in the web component that handles unauthenticated requests to the portal. An attacker can chain an authentication bypass with input handling issues to run commands with elevated privileges. Ivanti assigned a critical severity, and a CVE is pending assignment. Cloud managed Ivanti Neurons for Zero Trust Access is not affected.
The advisory includes guidance to verify integrity of system partitions and to review for persistence mechanisms. Ivanti recommends checking for unexpected scheduled tasks, modified startup scripts, unknown administrators, and outbound connections from the appliance.
What security teams should do
Install the fixed images on all supported Connect Secure and Policy Secure nodes and redeploy clusters. Apply the temporary mitigation on any systems that cannot be patched today. Restrict management access to trusted networks and place the portal behind additional inspection if possible.
Audit logs for suspicious requests to unauthenticated endpoints and for command execution artifacts. If compromise is suspected, rotate all stored credentials and certificates, and rebuild appliances from trusted media before restoring configuration.
This disclosure follows a pattern that has put VPNs and edge devices at the center of intrusion campaigns. Teams should expect more short notice fixes for network appliances and design maintenance windows that allow out of band patching, because adversaries continue to prioritize vendor edge software that exposes management or authentication surfaces to the internet.