U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability

The report describes active exploitation of critical Ivanti vulnerabilities (notably CVE-2023-35082 and high‑severity VPN flaws) that allow authentication bypass and remote code execution; attackers have used these to drop web shells and backdoors across many sectors worldwide, with over 2,100 devices observed compromised and a suspected Chinese actor (UTA0178) implicated. Rapid7, Volexity, Assetnote and others documented chaining and evasive modifications, while Ivanti and CISA have issued mitigations and advisories—organizations are urged to apply vendor fixes and rotate secrets after rebuilds.