HighZero-Day
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
BleepingComputer·Source published ·1 min read
What happened?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
Key details
- CISA urges immediate patching of an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1st.
- The vulnerability allows unauthenticated remote attackers to execute arbitrary commands without user interaction.
- Post-exploitation activity targeted Active Directory credentials, LAPS passwords, and BitLocker recovery keys.
- CISA added the flaw to its actively exploited list and ordered federal agencies to secure networks by Friday.
- Ivanti's Integrity Checker Tool may not detect exploitation because commands execute in memory.
- Shadowserver tracks over 5,600 internet-exposed ICS hosts, but their patch status is unknown.
What to look for
- Post-exploitation targeting of Active Directory credentials, LAPS passwords, and BitLocker recovery keys.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.