CISA warned today that a critical Ivanti vulnerability that can let threat actors gain remote code execution on vulnerable Endpoint Manager (EPM) appliances is now actively exploited in attacks. Ivanti released security updates to patch this security flaw in May, when it also addressed five other remote code execution bugs in EPM's Core server, all impacting Ivanti EPM 2022 SU5 and prior. On Tuesday, CISA followed suit and added the Ivanti EPM RCE flaw to its Known Exploited Vulnerabilities catalog, tagging it as actively exploited. Last month, Ivanti warned that threat actors were chaining two recently fixed Cloud Services Appliance (CSA) vulnerabilities to attack unpatched appliances. Ivanti EPM is an all-in-one endpoint management solution that helps admins manage client devices on various platforms, including Windows, macOS, Chrome OS, and IoT operating systems. While CISA's KEV catalog is primarily designed to alert federal agencies of vulnerabilities they should patch as soon as possible, organizations worldwide should also prioritize patching this vulnerability to block ongoing attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 02 Oct 2024 19:00:07 +0000