Ivanti urges customers to patch yet another critical vulnerability

Ivanti disclosed an XXE vulnerability (CVE-2024-22024, CVSS 8.3) in specific versions of Connect Secure, Policy Secure, and ZTA gateways that can allow access to restricted resources without authentication; patches and detailed KB mitigation instructions are available for supported versions and customers are urged to apply them immediately. Ivanti reports no evidence of exploitation of this CVE to date, but multiple other Ivanti vulnerabilities have been actively exploited, and CISA previously advised disconnecting vulnerable Ivanti products.