Threat Actor May Have Accessed Sensitive Info on CISA Chemical App

CISA notified stakeholders that an unknown threat actor exploited chained vulnerabilities in Ivanti Connect Secure to deploy a web shell on an Ivanti appliance and potentially access CSAT data (chemical inventories, security vulnerability assessments, site security plans, and personnel information) during a two-day window in January 2024; CISA reports no confirmed data exfiltration but recommends credential rotation and remediation and notes public exploits exist for the referenced Ivanti CVEs.