Source: ncsc.nl
Ivanti has patched a critical zero-day vulnerability in Connect Secure that allows unauthenticated remote command execution. The vulnerability has already been actively exploited in the wild prior to the patch being available. No public Proof-of-Concept is currently available, but NCSC expects one to emerge shortly, increasing the risk of widespread exploitation. The advisory was published by the Dutch National Cyber Security Centre (NCSC). Organizations using Ivanti Connect Secure are strongly advised to apply the patch immediately. The high exploitability and pre-authentication nature of the flaw make it especially dangerous for exposed systems.
