Chained Exploits, Stolen VPN Access: Hackers Target Ivanti Users Despite Patches

Shadowserver, Rapid7 and other firms report active exploitation of Ivanti SAML zero-day CVE-2024-21893 (CVSS 8.2) impacting Ivanti Connect Secure, Policy Secure and Neurons for ZTA; attackers have used chains involving CVE-2023-46805 and CVE-2024-21887, with evidence of many attacker IPs, at least dozens of compromised organizations, linkage to APT UTA0178 and use of KrustyLoader, while Ivanti has issued patches and additional mitigations.