Connect with us

Hi, what are you looking for?



Ivanti Patches High-Severity Vulnerability in VPN Appliances

An XXE flaw in Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways could lead to unauthenticated access to resources.

Ivanti on Thursday announced patches for a high-severity vulnerability impacting enterprise VPN and network access products.

Tracked as CVE-2024-22024 (CVSS score of 8.3) and described as an XML external entity (XXE) issue, the security defect was identified in the SAML component of Ivanti Connect Secure, Policy Secure, and ZTA gateway appliances.

According to Ivanti, the successful exploitation of the bug could allow an unauthenticated attacker to access certain restricted resources.

“This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure (version 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1), Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3,” the IT security and services company notes in its advisory.

Patches were included in Connect Secure versions 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3 and 22.6R2.2, Policy Secure versions 9.1R17.3, 9.1R18.4 and 22.5R1.2, and ZTA gateways versions 22.5R1.6, 22.6R1.5 and 22.6R1.7.

Ivanti also notes that patches released on January 31 to address two zero-day vulnerabilities exploited in attacks against government and military entities, along with four other security defects in its enterprise VPN products, mitigate CVE-2024-22024 as well.

“We have no evidence of this vulnerability being exploited in the wild as it was found during our internal review and testing of our code,” Ivanti says.

Although it has no evidence of CVE-2024-22024 being exploited against its customers, Ivanti urges them to ensure they have the latest patches.

Advertisement. Scroll to continue reading.

Customers who applied the January 31 or February 1 patches and factory reset their VPN appliances do not need to perform another factory reset, the company notes.

While Ivanti says in its advisory that the vulnerability was identified internally, attack surface management firm WatchTowr claims that its researchers found it and reported it to Ivanti on February 2. 

Ivanti, WatchTowr says, initially assigned a 2023 CVE to the bug, but later told the security firm that the issue is tracked as CVE-2024-22024.

Related: CISA Sets 48-Hour Deadline for Removal of Insecure Ivanti Products

Related: Ivanti EPMM Vulnerability Targeted in Attacks as Exploitation of VPN Flaws Increases

Related: Ivanti Patches Critical Vulnerability in Endpoint Manager

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.