Ivanti warns of another critical CSA flaw exploited in attacks

Ivanti warned that threat actors are exploiting a path-traversal admin-bypass (CVE-2024-8963) in Cloud Services Appliance, often chained with a high-severity command-injection bug (CVE-2024-8190) to bypass authentication and execute arbitrary commands on unpatched appliances; CISA added both CVEs to its Known Exploited Vulnerabilities catalog and federal agencies must patch quickly, while Ivanti recommends patch 519, rebuilding compromised appliances, and moving to CSA 5.0 where possible.