Ivanti Patches Critical Vulnerability in Endpoint Manager

Enterprise software provider Ivanti on Thursday warned of a critical-severity vulnerability in its Endpoint Manager product that could be exploited for remote code execution.
Successful exploitation of the vulnerability, Ivanti notes in its advisory, could allow the attacker to take over devices running the EPM agent.
CVE-2023-39336 impacts EPM 2022 Service Update 4 and all prior versions, including EPM 2021 iterations, the company explains.
The US-based software provider has not made further details on the flaw available publicly, instead limiting access to customers only, likely to provide them with more time to apply the patches.
Ivanti makes no mention of the vulnerability being targeted in the wild, but security defects in its products are known to have been exploited in malicious attacks, including as zero-days.
One of the most recent such examples is CVE-2023-38035, a critical-severity issue in Ivanti's Sentry mobile gateway.
It was patched in late August 2023, after being exploited as a zero-day against some of the company's customers.
Ivanti addressed CVE-2023-35078 and CVE-2023-35081, two exploited bugs in its Endpoint Manager Mobile product.
Both issues had been exploited as zero-days, likely by state-sponsored attackers, with CVE-2023-35078 likely exploited since at least April 2023, in attacks targeting the Norwegian government.


This Cyber News was published on www.securityweek.com. Publication date: Fri, 05 Jan 2024 12:43:04 +0000


Cyber News related to Ivanti Patches Critical Vulnerability in Endpoint Manager

Threat Brief: Ivanti Vulnerabilities CVE-2023-46805 and CVE-2024-21887 - On Jan. 10, 2024, Ivanti disclosed two new vulnerabilities in their Ivanti Connect Secure and Ivanti Policy Secure gateways: CVE-2023-46805 and CVE-2024-21887. The first CVE is a High severity authentication bypass vulnerability, and the second CVE ...
1 year ago Unit42.paloaltonetworks.com CVE-2023-46805 CVE-2024-21887
Ivanti discloses new zero-day flaw, releases delayed patches - Ivanti Wednesday released patches for two critical zero-day vulnerabilities that were disclosed earlier this month, but also warned customers of two new flaws, including a new zero-day that's under exploitation in the wild. In a security advisory on ...
1 year ago Techtarget.com CVE-2023-46805 CVE-2024-21887 CVE-2024-21888 CVE-2024-21893
Unified Endpoint Management: What is it and What's New? - What began as Mobile Device Management has now transitioned through Mobile Application Management and Enterprise Mobility Management to culminate in UEM. This progression underscores the industry's response to the ever-growing challenges of modern IT ...
1 year ago Securityboulevard.com
Ivanti discloses fifth vulnerability The Register - In disclosing yet another vulnerability in its Connect Secure, Policy Secure, and ZTA gateways, Ivanti has confused the third-party researchers who discovered it. Researchers at watchTowr blogged today about not being credited with the discovery of ...
1 year ago Go.theregister.com CVE-2024-22024
Ivanti confirms 2 zero-day vulnerabilities are under attack - CISA urged enterprises to address two Ivanti zero-day vulnerabilities that remain unpatched amid reports of active exploitation by a Chinese nation-state threat actor. Ivanti published a security advisory Wednesday for an authentication bypass ...
1 year ago Techtarget.com CVE-2023-46805 CVE-2024-21887
CISA confirms compromise of its Ivanti systems - CISA confirmed two of its internal systems were breached by a threat actor that exploited flaws in Ivanti products used by the U.S. cybersecurity agency. Ivanti on Jan. 10 disclosed two zero-day vulnerabilities that were under exploitation by a ...
11 months ago Techtarget.com CVE-2023-46805 CVE-2024-21887
China-backed attackers blamed for Ivanti zero-day exploits The Register - Security experts believe Chinese nation-state attackers are actively exploiting two zero-day vulnerabilities in security products made by Ivanti. If you're an admin or a user of the two products affected, VPN service Ivanti Connect Secure and network ...
1 year ago Go.theregister.com
Ivanti urges customers to patch yet another critical vulnerability - This vulnerability only affects a limited number of supported versions-Ivanti Connect Secure, Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3. Please read between the lines that there could be unsupported versions which will never see ...
1 year ago Malwarebytes.com CVE-2024-22024
Ivanti US Faces Security Crisis, Threatening Worldwide Systems - In a recent development, a critical server-side request forgery vulnerability has been discovered in Ivanti Connect Secure and Ivanti Policy Secure servers, marked as CVE-2024-21893. Security experts have confirmed that this vulnerability is being ...
1 year ago Cysecurity.news CVE-2024-21893 CVE-2023-46805 CVE-2024-21887
CISA Sets 48-hour Deadline for Removal of Insecure Ivanti Products - In an unprecedented move, the US government's cybersecurity agency CISA is demanding that federal agencies disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure products within 48 hours. Within 48 hours, the agency said federal ...
1 year ago Securityweek.com CVE-2023-46805 CVE-2024-21887 CVE-2024-21888 CVE-2024-21893
Ivanti warns critical EPM bug lets hackers hijack enrolled devices - Ivanti fixed a critical remote code execution vulnerability in its Endpoint Management software that can let unauthenticated attackers hijack enrolled devices or the core server. Ivanti EPM helps manage client devices running a wide range of ...
1 year ago Bleepingcomputer.com CVE-2023-39366
Ivanti: VPN appliances vulnerable if pushing configs after mitigation - Ivanti warned admins to stop pushing new device configurations to appliances after applying mitigations because this will leave them vulnerable to ongoing attacks exploiting two zero-day vulnerabilities. While the company didn't provide additional ...
1 year ago Bleepingcomputer.com CVE-2023-46805 CVE-2024-21887
Ivanti Patches High-Severity Vulnerability in VPN Appliances - Ivanti on Thursday announced patches for a high-severity vulnerability impacting enterprise VPN and network access products. Tracked as CVE-2024-22024 and described as an XML external entity issue, the security defect was identified in the SAML ...
1 year ago Securityweek.com CVE-2024-22024
Ivanti: Patch new Connect Secure auth bypass bug immediately - Today, Ivanti warned of a new authentication bypass vulnerability impacting Connect Secure, Policy Secure, and ZTA gateways, urging admins to secure their appliances immediately. The flaw is due to an XXE weakness in the gateways' SAML component that ...
1 year ago Bleepingcomputer.com CVE-2023-46805 CVE-2024-21887
Magnet Goblin Hackers Using Ivanti Flaws to Deploy Linux Malware - Hackers exploit unpatched Ivanti vulnerabilities to deploy malware on Linux systems. Magnet Goblin targets businesses using outdated software. Patch immediately and implement strong security measures to protect against these attacks. Cybersecurity ...
11 months ago Hackread.com CVE-2024-21887
Ivanti warns of Connect Secure zero-days exploited in attacks - Ivanti has disclosed two Connect Secure and Policy Secure zero-days exploited in the wild that can let remote attackers execute arbitrary commands on targeted gateways. The first security flaw is an authentication bypass in the gateways' web ...
1 year ago Bleepingcomputer.com
More mass exploits hit the same buggy Ivanti devices The Register - All manner of miscreants are piling onto the latest Ivanti flaw, a server-side request forgery vulnerability tracked as CVE-2024-21893, according to threat hunters tracking the string of CVEs that have been plaguing the software shop's gateways over ...
1 year ago Go.theregister.com CVE-2024-21893 Hunters
The Power of Endpoint Telemetry in Cybersecurity - Cisco - By filtering out unwanted data, this telemetry reduces noise and offers clear visibility into endpoint activities, including processes, parent-child process relationships, triggered events, files and network activity, whether malicious or benign. ...
5 months ago Feedpress.me
Ivanti zero-day flaws under 'widespread' exploitation - Two critical Ivanti vulnerabilities that remain unpatched are being widely exploited just five days following public disclosure. In a security advisory Wednesday, Ivanti urged users and administrators to mitigate two zero-day vulnerabilities that ...
1 year ago Techtarget.com CVE-2024-21887 CVE-2023-46805
CISO Corner: CIO Convergence, 10 Critical Security Metrics, & Ivanti Fallout - Welcome to CISO Corner, Dark Reading's weekly digest of articles tailored specifically to security operations readers and security leaders. Boards of directors don't care about a security program's minute technical details. With the US Securities and ...
1 year ago Darkreading.com
Malware Used in Ivanti Zero-Day Attacks Shows Hackers Preparing for Patch Rollout - The recently discovered Ivanti Connect Secure zero-day vulnerabilities could impact thousands of systems and the threat actors caught exploiting them appear to have been preparing for the release of patches. Threat intelligence and incident response ...
1 year ago Securityweek.com CVE-2023-46805 CVE-2024-21887
Ivanti Patches Critical Vulnerability in Endpoint Manager - Enterprise software provider Ivanti on Thursday warned of a critical-severity vulnerability in its Endpoint Manager product that could be exploited for remote code execution. Successful exploitation of the vulnerability, Ivanti notes in its advisory, ...
1 year ago Securityweek.com CVE-2023-39336 CVE-2023-38035 CVE-2023-35078 CVE-2023-35081
Two Ivanti Zero-Days Actively Exploited in the Wild - Ivanti customers have been urged to follow the security vendor's suggested workaround after it confirmed that two zero-day vulnerabilities in its Connect Secure and Policy Secure gateways are being actively exploited. Connect Secure is a VPN product ...
1 year ago Infosecurity-magazine.com CVE-2023-46805 CVE-2024-21887 CVE-2023-35078 CVE-2023-35081
Ivanti Researchers Report Two Critical Zero-Day Vulnerabilities - Ivanti researchers this week flagged two zero-day vulnerabilities discovered in its products - CVE-2023-46805 and CVE-2024-21887- that are already being actively exploited by threat actors. The vulnerabilities were found in Ivanti Connect Secure and ...
1 year ago Darkreading.com CVE-2023-46805 CVE-2024-21887- CVE-2024-21887
Ivanti Connect Secure zero-days now under mass exploitation - Two zero-day vulnerabilities affecting Ivanti's Connect Secure VPN and Policy Secure network access control appliances are now under mass exploitation. As discovered by threat intelligence company Volexity, which also first spotted the zero-days ...
1 year ago Bleepingcomputer.com CVE-2023-46805 CVE-2024-21887 CVE-2021-22893

Cyber Trends (last 7 days)