Ivanti warns of maximum severity CSA auth bypass vulnerability

Ivanti disclosed CVE-2024-11639, a critical authentication-bypass vulnerability in Cloud Services Appliance (CSA) affecting versions 5.0.2 and earlier that can grant remote attackers administrative privileges without authentication; Ivanti recommends upgrading to CSA 5.0.3. The advisory states there is no known public exploitation of this CVE, while also noting several other Ivanti products received patches and recounting prior zero-day exploitation campaigns against Ivanti appliances earlier in the year.