Ivanti fixes VPN gateway vulnerability allowing RCE, DoS attacks

Ivanti has released patches for multiple high-severity vulnerabilities in Connect Secure and Policy Secure gateways — including CVE-2024-21894, an unauthenticated heap overflow that can enable remote code execution — while thousands of Internet-exposed appliances remain vulnerable. The report cites large device counts via Shodan/ShadowServer, prior nation-state exploitation of Ivanti zero-days, CISA emergency directives to secure or disconnect affected appliances, and guidance to apply vendor patches immediately.