PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security Flash: CISA Order to Disconnect Ivanti Products

bugcrowd.com | blog | #zero-day | #cisa | #exploitation | #vulnerability | #vpn | #ivanti | #government-directive
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CISA ordered federal civilian agencies to disconnect Ivanti VPN appliances within 48 hours after four critical CVEs emerged, with roughly 30,000 exposed instances facing active exploitation.
Published
Collected

Related coverage

blog · wiz.io
Critical Vulnerabilities in Ivanti Exploited in-the-Wild: everything you need to know
Ivanti VPN vulnerabilities exploited in the wild: CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893, with patches out and CISA ordering agencies to isolate affected devices.
vulnerability · volexity.com
[CVE-2024-21887] Ivanti Connect Secure VPN Exploitation Goes Global
# Ivanti Connect Secure VPN Exploitation Goes Global January 15, 2024 Cem Gurkok, Paul Rascagneres, Sean Koessel, Steven Adair, and Tom Lancaster **_Important: If your organization uses Ivanti...
vulnerability · volexity.com
[CVE-2023-46805] Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
# Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN January 10, 2024 Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Tom Lancaster **_Volexity has...
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
Back