Ivanti warns of new Connect Secure zero-day exploited in attacks

Ivanti disclosed multiple critical vulnerabilities affecting Connect Secure, Policy Secure, and ZTA gateways — including an actively exploited SAML SSRF zero-day (CVE-2024-21893) and other flaws (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888) that allow authentication bypass, command injection, and privilege escalation; attackers have chained these to mass-exploit hundreds of internet-exposed appliances and deploy custom malware, cryptominers, and persistent backdoors, prompting patches, mitigations, and a CISA emergency directive.