Ivanti releases patches for VPN zero-days, discloses two more high-severity vulns

Ivanti released patches and updated mitigations for multiple high-severity vulnerabilities in Connect Secure, Policy Secure, and ZTA gateways, including two newly disclosed zero-days (CVE-2024-21888 privilege escalation and CVE-2024-21893 SSRF). Security researchers and CISA report active exploitation, mitigation bypasses, credential capture and webshell deployment in targeted networks; Ivanti and CISA urge urgent patching, factory resets, and proactive threat hunting while additional patches are rolled out.