Oct 11, 2024
0 new incidents, 1 with updates.
Updated
- ClosedPatched
Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor
Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.
Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)Closed Oct 9, 2024
