Ivanti Researchers Report Two Critical Zero-Day Vulnerabilities

Ivanti disclosed two actively exploited zero‑day vulnerabilities impacting Ivanti Connect Secure and Ivanti Policy Secure gateways: CVE-2023-46805 (authentication bypass, CVSS 8.2) and CVE-2024-21887 (authenticated command injection, CVSS 9.1). Mitigations are available from the vendor while patches are being released in waves (auth bypass patch due Jan 22; command injection patch due Feb 19); customers are urged to apply mitigations immediately and contact Ivanti Support for assistance.