Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications

CISA and the FBI released a joint advisory describing active exploitation of multiple Ivanti Cloud Service Appliance vulnerabilities (including zero-days) in September–October 2024. Threat actors chained an administrative bypass, SQL injection, and remote code execution flaws to obtain credentials, deploy webshells, and in at least one case move laterally; the advisory includes detailed exploit chains, IOCs, MITRE ATT&CK mappings, victim detection narratives, and remediation/mitigation guidance (notably upgrading EOL Ivanti CSA 4.6 systems).