Dive Brief:
- Malicious actors have exploited a high-severity vulnerability in Ivanti Cloud Service Appliance version 4.6 and before in a limited number of customers, just days after the company released security updates, Ivanti said Friday in an updated advisory.
- The operating system command injection vulnerability, listed as CVE-2024-8190, could allow an authenticated attacker to obtain remote code execution. The vulnerability has a CVSS score of 7.2, and the advisory notes an attacker must obtain admin-level privileges to exploit the CVE.
- The company warned that Ivanti CSA version 4.6 had reached end of life and no longer receives patches. Ivanti urged customers to upgrade to version 5.0 in order to receive continued support. Those already running version 5.0 do not need to take any additional actions.
Dive Insight:
Ivanti is working with a limited number of customers affected by the vulnerability, a spokesperson confirmed Friday via email. The company has not released any details on the specific attacks.
The Cybersecurity and Infrastructure Security Agency added the vulnerability to its known exploited vulnerabilities catalog. The move requires federal civilian executive branch agencies to address the vulnerabilities by Oct. 4.
CISA was targeted earlier this year by hackers exploiting critical vulnerabilities in Ivanti Connect Secure. Ivanti in April announced a comprehensive effort to overhaul its internal security practices.
The company said users can check for potential compromise by reviewing the Ivanti CSA for newly added or modified administrative users. Some compromise attempts may show up in broker logs, which are available locally on the system. Users can also review endpoint detection and response alerts.
More threat groups are targeting older vulnerabilities in end-of-life applications as some customers run outdated software in aging equipment and forget to apply security upgrades.
