InfoSecBulletin Cybersecurity for mankind
Ivanti has issued a warning regarding two new high-severity vulnerabilities in its Connect Secure and Policy secure solutions, identified as CVE-2024-21888 (CVSS score: 8.8) and CVE-2024-21893 (CVSS score: 8.2) respectively. Furthermore, the company has alerted that one of these vulnerabilities is actively being exploited in the wild.
The vulnerability CVE-2024-21888 allows attackers to gain admin privileges by exploiting a privilege escalation issue in the web component of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x).
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
CVE-2024-21893 is a server-side request forgery vulnerability in SAML component of Connect Secure (9.x, 22.x), Policy Secure (9.x, 22.x) and Neurons for ZTA. An authenticated attacker can exploit this flaw to access restricted resources.
The company warns that the situation is still changing, and multiple threat actors can quickly adjust their tactics to exploit these issues in their campaigns.
“At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted. Ivanti expects the threat actor to change their behavior and we expect a sharp increase in exploitation once this information is public – similar to what we observed on 11 January following the 10 January disclosure.” reads the advisory.
“Be aware that the situation is still evolving. Ivanti will update this knowledge base article as more information becomes available.”
The software firm suggests using the “mitigation.release.20240126.5.xml” file from the download portal as a temporary solution for CVE-2024-21888 and CVE-2024-21893.
In January 2024, Ivanti reported that hackers were using two new vulnerabilities to run commands on specific gateways.
Today, researchers from cybersecurity company Synacktiv analyzed a Rust malware called KrustyLoader, which was used by threat actors to exploit vulnerabilities.
