Cyble Sensors Detect Exploitation Of Ivanti Vulnerabilities

Cyble Global Sensor Intelligence reports ongoing, real-world exploitation of two high-severity Ivanti Connect Secure vulnerabilities (an authentication bypass CVE-2023-46805 and a command-injection RCE CVE-2024-21887). The advisory describes how attackers enumerate unauthenticated REST endpoints, leverage path traversal and a vulnerable license API to inject commands, and have been observed exfiltrating data and establishing reverse tunnels; tens of thousands of internet-exposed instances increase the scale and urgency, with vendor mitigations and staged patches forthcoming.