Dual Zero-Day Threats in Ivanti Connect Secure and Policy Secure Gateways – CVE-2023-46805 and CVE-2024-21887 

Two zero-day vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways—CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection)—are being actively exploited in the wild, and when chained can allow unauthenticated remote code execution; CISA has added them to its Known Exploited Vulnerabilities catalog, Ivanti has issued mitigations while patches are developed, and Qualys has released detection QIDs to help organizations scan and remediate affected systems.